Workflow & Core Tools · daymade/claude-code-skills

gangtise-copilot

Name: gangtise-copilot
Author: daymade/claude-code-skills

Gangtise (岗底斯投研) OpenAPI skill suite installer and diagnostic tool. One-click install 19 official skills (data, research, utility), configure accessKey/secretAccessKey, run health diagnostics. Trigger when user mentions Gangtise, 岗底斯, any gangtise-* skill, credential setup, or reports errors like 'token is invalid' / '接口地址错误'.

L4 High-Privilege · Graded auth & full auditV1 Commit-PinnedExecute CommandNetwork AccessWrite FileDual-pass Audit

Control levels describe skill capabilities and suggested control measures; they do not represent quality or safety certifications, nor do they dictate usability. Usage decisions rest entirely with users and administrators. Different agent hosts apply varying constraints; do not assume hosts provide automatic protection. Third-party skill copyrights belong to their original authors. Use at your own risk.

1How It Works & Mechanism

Core architecture relies on executable scripts rather than prompt engineering: All three capability entry points—installation (install_gangtise.sh), credential configuration (configure_auth.sh), and diagnostics (diagnose.sh)—are implemented entirely via bash/python scripts, while SKILL.md serves solely as a routing guide and documentation manual.

daymade-financial/gangtise-copilot/SKILL.md

| 1. Install Gangtise skills (minimal default, workshop alias, full, or `--only` custom) | `scripts/install_gangtise.sh` | See `references/installation_flow.md` |

The wrapper layer directly addresses the critical pain point of upstream undiscoverability (no public manifest, scattered zip files on OBS with directory listing disabled, dual naming scheme confusion) by consolidating discovery, distribution, credential configuration, and diagnostics into a single command.

Installation mechanism: Downloads 4 zip archives from the official Huawei Cloud OBS bucket → unzips them to a temporary /tmp staging area → copies them to the canonical path ~/.local/share/gangtise-copilot/skills → creates symlinks in the skills directories of all detected agents (claude-code/openclaw/codex).

daymade-financial/gangtise-copilot/scripts/install_gangtise.sh

BASE_URL="https://gts-download.obs.myhuaweicloud.com/skills"

The 4 zip files contain a total of 19 skill directories (bundle mapping is hardcoded in scripts: gangtise-skills-client/gangtise-research/gangtise-skills/gangtise-web-client); the symlink architecture ensures credential rotation and upstream updates propagate automatically across all agents; executions are idempotent (canonical target is cleared via rm -rf and recopied, while non-symlink legacy installs are backed up to /tmp/gangtise-copilot-backups).

Credential management mechanism: Single shared credential file + per-skill symlinks. configure_auth.sh writes accessKey/secretAccessKey to ~/.config/gangtise/authorization.json (mode 600), writes a bare token to ~/.GTS_AUTHORIZATION for upstream CLIs, and creates symlinks pointing to the shared file in the scripts/.authorization directory of each installed skill.

daymade-financial/gangtise-copilot/scripts/configure_auth.sh

AUTH_FILE="${XDG_CONFIG_DIR}/authorization.json" RUNTIME_TOKEN_FILE="$HOME/.GTS_AUTHORIZATION"

Because all 19 skills require their own .authorization file, rotating credentials only requires modifying a single shared file; file permissions are restricted to mode 600 to secure plaintext keys; a live auth verification is performed immediately after writing (see next item). SKILL.md explicitly instructs running configure_auth.sh even if the shared file already exists to repair any missing symlinks.

Live verification mechanism: Both configure_auth.sh and diagnose.sh POST credentials to the Gangtise OAuth endpoint to exchange for a token; diagnose.sh then queries the RAG endpoint using this token to test capability-layer liveness; responses are parsed via classify_response.py without echoing tokens or full response bodies.

daymade-financial/gangtise-copilot/scripts/diagnose.sh

AUTH_ENDPOINT="https://open.gangtise.com/application/auth/oauth/open/loginV2" RAG_ENDPOINT="https://open.gangtise.com/application/open-data/ai/search/knowledge_base"

The server returns HTTP 200 even for invalid credentials, so scripts determine status based on body structure (code==000000) rather than HTTP status codes; RAG diagnostics distinguish among reachable/empty results/permission denied/auth rejected/quota exceeded, preserving http_status/code/errorType/traceId while sanitizing tokens. Note from classify_response.py: 'Classify Gangtise auth/RAG responses without printing tokens or response bodies.'

Value layer lies in the 19-skill capability matrix routing: SKILL.md embeds a comprehensive registry categorizing skills into 'Data Layer (6) + Workflow Layer (10) + Tool Layer (3)', routing user data queries (K-line/financial reports/valuation/research reports/chief analyst views/thesis comparison, etc.) to the appropriate upstream skill and runner.

daymade-financial/gangtise-copilot/SKILL.md

Gangtise's 19 skills form a **two-dimensional matrix** (data tier × operation type) that is not clearly documented. Use this table to route a user question to the right skill

The matrix also documents real-world pitfalls such as ISSUE-007 (most accounts lack skills-backend/* ACLs, making -client skills non-functional), leading the default preset to be consolidated into minimal (3 legacy open-* skills).

Wrapper architecture principle: Never vendor upstream files—the repository contains no local copies of Gangtise skill code; every run fetches the current version fresh from the canonical OBS URL; bug fixes are applied via runtime remediation (references/known_issues.md) rather than upstream modification.

daymade-financial/gangtise-copilot/SKILL.md

**Never vendor upstream files.** This skill directory contains no copy, fork, or excerpt of any Gangtise skill content.

'Repairs happen at runtime, not at ship time' + 'Always ask before touching upstream files' (prompting via AskUserQuestion); this explains why references/known_issues.md includes 24.5KB of documented runtime issues and remediation recipes.

2Core Capabilities

01One-click installation of 19 official Gangtise skills across multiple agents (minimal/workshop/full/--only presets + target auto-detection)

02accessKey/secretAccessKey configuration + live server-side validation (token exchange with uid/userName display)

03Read-only health diagnostics: install integrity/credential files and symlinks/dual-layer liveness (OAuth + RAG) with exit codes 0/1/2

0419-skill capability registry routing (Data/Workflow/Tool matrix + per-runner parameters)

05Single-point credential rotation (updating one shared file automatically propagates via symlinks)

06Single-file fallback download/install from GitHub (falls back to api.github.com contents when git clone times out or fails)

3External Dependencies

Kind	Dependency / Endpoint
network	华为云 OBS 技能分发桶
api	Gangtise OAuth loginV2（accessKey/secretAccessKey 换 Bearer token）
api	Gangtise RAG knowledge_base 语义检索（diagnose 能力层 liveness）
network	GitHub contents API（SKILL.md 回退下载法，非脚本默认路径）
cli	curl / unzip / python3 / git（脚本前置检查与执行工具）

4Recommended Governance & Evidence

Suggested Controls for Safe Operation

For Agent Runtime

Graded/per-use authorization, sandbox recommended

For Administrators

Approval workflow, rollback support, full audit

Evidence & Triggers (File Paths & Excerpts)

scripts/: Local script and command execution: scripts/install_gangtise.sh (bash: download + extract + install + symlink)
网络端点: Declared external network access: curl download from https://gts-download.obs.myhuaweicloud.com/skills/<bundle>.zip (4 bundles)
本地工作目录: File read/write and artifact output: ~/.config/gangtise/authorization.json (mode 600)

Audit Notes: Meets two conditions for Amber rating: ① Credential Handling: configure_auth.sh/diagnose.sh reads and writes plaintext accessKey/secretAccessKey (~/.config/gangtise/authorization.json, ~/.GTS_AUTHORIZATION) and sends credentials via POST to open.gangtise.com for live validation (handling credentials triggers Amber regardless of transmission); ② Third-Party Remote Package Dependency: The installer downloads 19 upstream skill zip files from a third-party OBS bucket (without signature or hash verification, only size thresholds), and the extracted executable code falls outside the audit boundary of this repository, introducing supply chain attack surfaces. Because endpoints are predictable (official Gangtise domain + OBS), scripts contain no obfuscation or hidden transmissions, and credential hygiene is strictly enforced (mode 600, tokens suppressed, sanitized response classification, non-target directories left untouched), the risk does not elevate to Red.

5Second-Pass Verification

[ok] OBS 桶下载端点与 bundle 数量（19 技能/4 zip） — install_gangtise.sh BASE_URL 常量 + BUNDLES 数组（4 项，共 19 技能名）与 SKILL.md bundle map 一致；curl --fail -o + wc -c 大小门槛在源码中。
[ok] 凭证读写在三个脚本中都真实存在 — configure_auth.sh 写 ~/.config/gangtise/authorization.json（600）+ ~/.GTS_AUTHORIZATION + live auth；diagnose.sh 读 authorization.json 的 accessKey/secretAccessKey 并 POST loginV2；均逐字可查。
[ok] live 验证按 body shape（code==000000）而非 HTTP 码 — configure_auth.sh 'if echo "$response" | grep -q '"code":"000000"'' 与 credentials_setup.md『Gangtise returns HTTP 200 for both success and failure』一致。
[ok] 诊断只读且不打印 token — diagnose.sh 无写文件语句；classify_response.py docstring『without printing tokens or response bodies』+ 字段白名单（http_status/code/errorType/traceId）；tests 断言 'secret' 不出现在分类结果。
[ok] wrapper 不 vendor 上游 + 上游内容不在本仓 — 目录 glob 无 gangtise-* 上游技能内容（仅 scripts/references/config-template/tests）；SKILL.md『no copy, fork, or excerpt of any Gangtise skill content』成立。
[ok] 安全反例搜索：是否有漏网端点/回调/混淆 — 全目录扫描仅 OBS、open.gangtise.com（loginV2 + knowledge_base + 文档中 skills-backend/open-quote 示例）、api.github.com（SKILL.md 回退法）、status.huaweicloud.com（文档链接）；无遥测/无外发到第三方。
[ok] 功能声明 vs 实际能力 — 『One-click install 19 official skills, configure accessKey/secretAccessKey, run health diagnostics』三项分别对应 install/configure/diagnose 脚本 + SKILL 路由；最小化 preset 规避 ISSUE-007 的说明与 known_issues.md 复现证据一致。
[ok] 元数据（commit/license/stars） — 本地 HEAD == pin d5c4678cb5d4fd6acc9c922690df035dbd33d247；GitHub API：MIT、stars 1385（2026-09-09 实采）、pushed_at 2026-09-09T12:33:29Z。

6Verdict & Scenarios

Solves critical real-world pain points: Upstream 19 skills are undiscoverable (no manifest, OBS listing disabled, dual naming lines); this wrapper unifies discovery, distribution, credential setup, and diagnostics into a single install process.

Credential management is streamlined into a single shared file with symlink propagation, requiring changes in only one place during rotation.

Diagnostic scripts are strictly read-only and enforce response sanitization with self-tests, maintaining high security standards uncommon among similar installers.

Institutional knowledge formalized into an ISSUE knowledge base: Root causes, reproductions, and fix recipes are provided for issues like Bearer double-prefixing, bundle-only skills, and skills-backend ACL errors.

Conservative defaults: The minimal preset circumvents ISSUE-007 ACL pitfalls, preventing users from inadvertently installing a broken or inaccessible suite.

Best for: Ideal for investment research professionals with a Gangtise (岗底斯投研) OpenAPI account/authorization: enables one-stop installation of the official skill suite, accessKey/secretAccessKey setup, troubleshooting issues like 'token is invalid / 接口地址错误 / improper installation' via diagnose, and routing data queries to the correct upstream skill using the built-in registry. Also suitable for users maintaining a unified skill library across multiple agents (Claude Code/OpenClaw/Codex).

Not for: Not suitable for users without a Gangtise account or those unwilling to integrate third-party financial data services (auth verification will fail); not suitable for security-conscious environments concerned about installing unsigned skill archives from third-party OBS buckets without supply chain audibility; not suitable for lightweight users needing only a single upstream skill who prefer not to introduce a wrapper (manual curl+unzip is preferable); not suitable for scenarios expecting the wrapper to bundle Gangtise data natively—it operates solely as an installation/configuration/diagnostic layer, requiring authorized account credentials to query data via upstream skills.

Install Agent-Ready

① Verified Mirror 2026-09-09

Option A · Direct DownloadDownload gangtise-copilot.tar.gz

sha256: 7ba5dccf4fc1c4ad…

Option B · Copy Guide for Agent

install.json

Agents automatically download and verify mirrors from this JSON guide.

② Upstream GitHub

GitHub Repo ↗

Pinned to commit d5c4678cb5.