Claude Code, Skill
Taxue Invest
Taxue Invest, a skill listed in the PlugVet directory.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
skills/invest-cli/docs/复核报告_2026-09-22_第五轮_独立验证.md, line 77
$ invest-cli ... route.fetch("us","AAPL",order=["tencent"])
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
skills/invest-cli/scripts/check.py, line 30
ok = subprocess.run(cmd, cwd=ROOT).returncode == 0
skills/invest-cli/scripts/test_cli_guards.py, line 35
proc = subprocess.run(
skills/invest-cli/scripts/test_cli_guards.py, line 314
proc = subprocess.run(
Show more
skills/invest-cli/scripts/test_cli_guards.py, line 554
bare = subprocess.run([sys.executable, str(cli), "watchlist"],
skills/invest-cli/scripts/test_cli_guards.py, line 556
explicit = subprocess.run([sys.executable, str(cli), "watchlist", "list"],
skills/invest-cli/scripts/test_contract.py, line 115
status = subprocess.run(["ttskill", "status"], capture_output=True, text=True, timeout=15)
skills/invest-cli/scripts/test_envelope.py, line 33
return subprocess.run(
skills/invest-cli/scripts/test_mx_data_router.py, line 224
out = subprocess.run([sys.executable, "-c", code], capture_output=True,
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Serious
accepts a host from input, with no fixed list in this file.
NETWORK_HOST_FROM_INPUT
skills/invest-cli/docs/复核报告_2026-09-22_第五轮_独立验证.md, line 77
$ invest-cli ... route.fetch("us","AAPL",order=["tencent"])
skills/invest-cli/scripts/cmd_fund.py, line 51
resp = requests.post(
skills/invest-cli/scripts/cmd_fund.py, line 161
f_snap = pool.submit(lambda: unwrap_snapshot(fetch("fund", keyword)))
Show more
skills/invest-cli/scripts/cmd_intent.py, line 258
return fetch("stock", target, market=market)
skills/invest-cli/scripts/cmd_intent.py, line 288
return fetch("fund", target)
skills/invest-cli/scripts/cmd_research.py, line 16
同源同缓存），股息率参照集走 route.fetch("screen", …)（妙想），资讯走 argo。
skills/invest-cli/scripts/cmd_research.py, line 271
res = fetch("screen", "股息率大于4%的A股，按股息率从高到低排序")
skills/invest-cli/scripts/cmd_screen.py, line 44
res = fetch("screen", condition)
skills/invest-cli/scripts/cmd_stock.py, line 46
resp = requests.post(
skills/invest-cli/scripts/test_source_guards.py, line 871
res = fetch("fund", "-1", invoke=_ambiguous, order=["hithink", "ttskill", "eastmoney"])
skills/invest-cli/scripts/test_source_guards.py, line 889
res = fetch("fund", "110011", invoke=_invoke, order=["hithink", "ttskill"])
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
skills/invest-cli/scripts/_common.py, line 22
"""环境变量缺失时的回退：从 ~/.env.secrets 读
skills/invest-cli/scripts/_common.py, line 34
for p in (Path.home() / ".env.secrets", Path.home() / ".zsh_secrets"):
skills/invest-cli/scripts/_common.py, line 53
"""东财 API key：显式参数 > 环境变量 > ~/.env.secrets"""
Show more
skills/invest-cli/scripts/_common.py, line 57
"缺少 EASTMONEY_APIKEY（应放在 ~/.env.secrets，或经环境变量传入）")
skills/invest-cli/scripts/sources/eastmoney.py, line 53
from .env import read_credential_file, read_env
skills/invest-cli/scripts/sources/fmp.py, line 88
from .env import read_credential_file, read_env
skills/invest-cli/scripts/sources/fred.py, line 67
from .env import read_credential_file, read_env
skills/invest-cli/scripts/sources/hithink.py, line 99
from .env import read_env
skills/invest-cli/scripts/sources/index_hub.py, line 105
val = os.environ.get("INDEX_HUB_API_KEY", "").strip()
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 90927de6e7d5. requests shell access. The manifest names this permission. accepts a host from input, with no fixed list in this file. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 90927de6e7d581725969ae4f886464e6f398b00f
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.