ClawAudit verdict

股海罗盘 - A股股票量化分?

gh-data

🟢 Trusted

Low risk — reviewed by ClawAudit, behavior matches stated purpose

Chinese stock quantitative analysis skill that fetches public market data from named sources (Sina, Tencent, Eastmoney) and posts to a named analysis API; credential_access is for reading GHDATA_API_URL env var, not secret harvesting.

⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.

Automated static analysis — not a human review. ClawAudit flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.

security

transparency

maintenance

Permission integrity

Code accesses API keys/tokens but declares no environment variables

credential_access

Findings (5)

Pattern match high

Possible hardcoded credential

ghdata/config.py · prose · downgraded · api_key="00000000-0000-0000-0000-000000000000

Pattern match medium

HTTP request to bare IP address — common in malicious payloads

ghdata/config.py · prose · downgraded · http://192.168.1.100

Pattern match low

Python os.environ.get — reads environment variable

ghdata/config.py · prose · downgraded · os.environ.get(

Pattern match low

Python urllib.request — network access

ghdata/data_fetcher.py · prose · downgraded · urllib.request

Pattern match low

References agent memory files

ghdata/predictor.py · prose · downgraded · MEMORY.md

Permissions & capabilities

No declared permissions — minimal attack surface.

credential_access

Is this flag fair?

Check another skill Browse the registry Auditing your own skills or configs? Use the API