Claude Code, Skill
A Share Mainline Os
A Share Mainline Os, a skill listed in the PlugVet directory.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit f242b9a620b0.
PERMISSION_SHELL_UNDECLARED
Why this grade
- PERMISSION_SHELL_UNDECLARED Medium
Runs shell commands that the manifest or description does not mention.
adapters/shared/a_stock_data_upstream_smoke.py, line 26
subprocess.run(["git", "init", "--quiet", str(checkout)], check=True)
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
requests shell access. No manifest field names shell or command execution. can delete files.
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES
adapters/shared/a_stock_data_upstream_smoke.py, line 26
subprocess.run(["git", "init", "--quiet", str(checkout)], check=True)
adapters/shared/a_stock_data_upstream_smoke.py, line 27
subprocess.run(
adapters/shared/a_stock_data_upstream_smoke.py, line 31
subprocess.run(
Show more
adapters/shared/a_stock_data_upstream_smoke.py, line 45
subprocess.run(
adapters/shared/a_stock_data_upstream_smoke.py, line 49
commit = subprocess.check_output(
adapters/shared/install_a_stock_data.py, line 36
subprocess.run(["git", "init", "--quiet", str(checkout)], check=True)
adapters/shared/install_a_stock_data.py, line 37
subprocess.run(
adapters/shared/install_a_stock_data.py, line 41
subprocess.run(
Install and update
Concern
dependencies are not pinned.
INSTALL_UNPINNED
requirements.txt, line 1
requests>=2.31,<3
Network
Concern
can reach a host that is not written as a fixed address. can reach www.cninfo.com.cn. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
adapters/shared/a_stock_data_smoke.py, line 16
with urllib.request.urlopen(request, timeout=15) as response:
adapters/shared/a_stock_data_upstream_smoke.py, line 58
with urllib.request.urlopen(request, timeout=20) as response:
plugins/a-share-mainline-os-claude/skills/stock-buddy/scripts/danger_scan.py, line 167
r = requests.get("http://www.cninfo.com.cn/new/data/szse_stock.json",
Show more
plugins/a-share-mainline-os-claude/skills/stock-buddy/scripts/danger_scan.py, line 179
r = requests.post("https://www.cninfo.com.cn/new/hisAnnouncement/query",
plugins/a-share-mainline-os-claude/skills/stock-buddy/scripts/danger_scan.py, line 214
d1 = requests.post("https://irm.cninfo.com.cn/newircs/index/queryKeyboardInfo",
plugins/a-share-mainline-os-claude/skills/stock-buddy/scripts/danger_scan.py, line 219
rows = requests.post("https://irm.cninfo.com.cn/newircs/company/question",
plugins/a-share-mainline-os-claude/skills/stock-buddy/scripts/danger_scan.py, line 241
r = requests.get(f"https://qt.gtimg.cn/q={market}{code}",
plugins/a-share-mainline-os-claude/skills/stock-buddy/scripts/danger_scan.py, line 259
r = requests.get(f"https://www.cls.cn/v1/roll/get_roll_list?{qs}&sign={sign}",
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
plugins/a-share-mainline-os-claude/skills/stock-buddy/scripts/danger_scan.py, line 307
if not os.environ.get("IWENCAI_API_KEY"):
plugins/a-share-mainline-os-claude/skills/stock-daily/scripts/board_fund_flow_cache.py, line 1363
token = os.environ.get("TUSHARE_TOKEN", "")
plugins/a-share-mainline-os-claude/skills/stock-daily/scripts/board_fund_flow_cache.py, line 1482
args.db, os.environ.get("TUSHARE_TOKEN", ""),
Show more
plugins/a-share-mainline-os-claude/skills/stock-daily/scripts/board_fund_flow_cache.py, line 1498
args.db, os.environ.get("TUSHARE_TOKEN", ""),
plugins/a-share-mainline-os-codex/skills/stock-buddy/scripts/danger_scan.py, line 307
if not os.environ.get("IWENCAI_API_KEY"):
plugins/a-share-mainline-os-codex/skills/stock-daily/scripts/board_fund_flow_cache.py, line 1363
token = os.environ.get("TUSHARE_TOKEN", "")
plugins/a-share-mainline-os-codex/skills/stock-daily/scripts/board_fund_flow_cache.py, line 1482
args.db, os.environ.get("TUSHARE_TOKEN", ""),
plugins/a-share-mainline-os-codex/skills/stock-daily/scripts/board_fund_flow_cache.py, line 1498
args.db, os.environ.get("TUSHARE_TOKEN", ""),
scripts/build_release.py, line 47
forbidden = ("__pycache__", ".pyc", "/outputs/", "/.env")
.gitignore, line 3
.env
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit f242b9a620b0. requests shell access. No manifest field names shell or command execution. can delete files. dependencies are not pinned. can reach a host that is not written as a fixed address. can reach www.cninfo.com.cn. The description does not name that host. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: f242b9a620b01d8c01e58ef82dd5fe72c376facd
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.