ttfund-skills
天天基金官方 Skills 网关调用封装。 Use when: 查询天天基金/天天财富基金数据、基金搜索、基金净值、基金持仓、基金经理、指数、黄金、债市、活期宝或官方 ttfund skills。 Not for: 交易执行、券商/银行账户操作、FRED/Tushare/yfinance/AKShare 结构化数据源、投资建议。 Output: 通过官方网关返回的结构化 JSON 事实数据，带 source/asOf 后再进入 F207 数据层。 GOTCHA: 必须有本机 `TTFUND_APIKEY`，且 key 只放环境变量或 gitignored `.env`，绝不写入 git 或回复全文。
70
86%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The required workflow calls an outsider HTTP gateway (`https://skills.tiantianfunds.com/.../invoke`) and then reads the gateway’s response as free-form text (`await response.text()`), which can be logged/forwarded into the agent/LLM context via downstream components.
- Repository
- zts212653/clowder-ai
- Commit
80782c5
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.