同花顺问财ETF选股

This skill appears to be a straightforward client for the 同花顺/问财 (iwencai) API, but exercise caution before installing or enabling it: - Metadata mismatch: The skill's manifest declares no required environment variables, but the instructions and CLI code require IWENCAI_API_KEY (and refer to IWENCAI_API_URL). Do not provide your API key until you confirm the skill legitimately needs it. - Verify the endpoint and owner: The CLI uses https://openapi.iwencai.com/v1/query2data. Confirm that this is the official endpoint and that you trust the unknown owner/publisher before supplying credentials. - Review network behavior: The skill sends your full query text to the external service and may retry with relaxed queries up to 2 times. Avoid sending sensitive or private data in queries because it will be transmitted to an external API and may be logged. - Confirm credential scope: Use an API key with limited scope/usage and monitor its usage. Prefer creating a dedicated key for this skill rather than reusing high-privilege credentials. - Test locally first: Inspect and run the provided scripts locally in a safe environment (without exposing production secrets) to validate behavior and ensure IWENCAI_API_URL usage is as expected (the CLI hardcodes DEFAULT_API_URL and does not read an IWENCAI_API_URL env var despite mentioning it in docs). Given the manifest/instructions inconsistency and unknown publisher, treat this skill as suspicious until you validate the above points.