gangtise-copilot
An agent skill by daymade, from daymade/claude-code-skills. Tags: api, automation, marketplace, research, setup.
What it does
Gangtise (岗底斯投研) OpenAPI skill suite installer and diagnostic tool. One-click install 19 official skills (data, research, utility), configure accessKey/secretAccessKey, run health diagnostics. Trigger when user mentions Gangtise, 岗底斯, any gangtise-* skill, credential setup, or reports errors like 'token is invalid' / '接口地址错误'.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add daymade/claude-code-skills --skill gangtise-copilotOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/daymade/claude-code-skills
cp -r claude-code-skills/daymade-financial/gangtise-copilot ~/.claude/skills/gangtise-copilotSafety box score
Grade F, high risk: 68 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill installs and configures the Gangtise OpenAPI suite by downloading upstream ZIPs, writing shared credentials, and symlinking skills into local agent directories. The main risks are credential handling, network calls to Gangtise endpoints, and recursive replacement of existing local installs; opting into the full preset also enables upstream skills that can mutate Gangtise account data such as stock pools.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 2 (moderate) | It ships runnable Bash and Python entry points (`scripts/install_gangtise.sh`, `scripts/configure_auth.sh`, `scripts/diagnose.sh`, `scripts/classify_response.py`) that execute shell commands, `curl`, `unzip`, `cp`, `ln`, and `python3`. |
| Network access | 3 (high) | It downloads bundles from `https://gts-download.obs.myhuaweicloud.com/skills/<bundle>.zip` and posts credential material to Gangtise endpoints like `https://open.gangtise.com/application/auth/oauth/open/loginV2` and the RAG API. |
| Filesystem reach | 3 (high) | It writes and deletes in user-home locations such as `~/.config/gangtise/authorization.json`, `~/.GTS_AUTHORIZATION`, `~/.local/share/gangtise-copilot/skills`, and agent skill dirs under `~/.claude`, `~/.agents`, and `~/.openclaw`. |
| Secrets & credentials | 3 (high) | It explicitly accepts `accessKey` and `secretAccessKey`, persists them to disk, and derives a bearer token in `~/.GTS_AUTHORIZATION`, so it handles long-lived account credentials. |
| Privilege & persistence | 1 (low) | It does not call `sudo` or register services, but the docs tell users to add `NO_PROXY` to shell startup files and the scripts manage user-level permissions with `chmod 600`/`700`. |
| Instruction hijack surface | 1 (low) | The SKILL.md is a strong agent-facing prompt with directives like `When in doubt, start with Capability 3` and `This is the only section you need to read`, but it does not request ignoring safeguards or following remote instructions. |
| Irreversible actions | 2 (moderate) | The installer automatically deploys up to 19 skills into multiple agent directories and can replace existing manual installs with `rm -rf`/`ln -sfn`, while the full preset exposes upstream skills that can create or delete stock pools. |
| Transparency | 2 (moderate) | The installed upstream skill code is fetched at runtime from opaque OBS ZIPs and the repo intentionally does not vendor or pin those contents, so the exact code being installed is not fully reviewable here. |
Before installing
- Read `scripts/install_gangtise.sh`; it rewrites `~/.local/share/gangtise-copilot/skills` and symlinks into agent skill dirs.
- Read `scripts/configure_auth.sh`; it posts credentials to `open.gangtise.com` and writes `~/.config/gangtise/authorization.json` plus `~/.GTS_AUTHORIZATION`.
- Start with `--preset minimal` unless you explicitly want the write-capable `--preset full` suite.
- If you plan to use real credentials, test in a scratch account first and confirm you are comfortable with them being stored locally.
Rated 2026-10-19 by an automated review of 13 files from the skill's repository.
Source
- Repository
- daymade/claude-code-skills (all skills from this repository)
- Path
- daymade-financial/gangtise-copilot/SKILL.md
- Branch
- main
- Updated
- 2026-09-20
Related skills
- agent-web-search-setup — Sets up working web search on an agent whose model backend cannot run it.
- skills-search — This skill should be used when users want to search, discover, install, or manage Claude Code skills from the CCPM registry.
- step-parts — Find, evaluate, and download common purchasable CAD parts from step.parts, including named off-the-shelf actuators, servos, motors, electronics boards.
- agents-connect — Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies.
- cursor-sdk — Guide users building apps, scripts, CI pipelines, or automations on top of the Cursor TypeScript SDK (`@cursor/sdk`).
- gh-cli — Enforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns.