my_stock_watchlist_skill
v1.0.1当用户提到“观察列表”或“股票观察”时触发。用于管理钉钉多维表格中的股票观察名单。
⭐ 0· 89·0 current·0 all-time
by@canonxu
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill declares and documents only watchlist operations (add, delete, query) against a specific DingTalk multi-dimensional table. The listed dependency (dingtalk-ai-table) is the expected mechanism to perform those actions, so the capability request is proportional to the stated purpose.
Instruction Scope
Runtime instructions are narrowly scoped: they reference a single external table URL, a Base ID and Sheet ID, and call specific records APIs (GET/POST/DELETE) via dingtalk-ai-table. The instructions do not ask the agent to read arbitrary files, system environment variables, or send data to unrelated endpoints.
Install Mechanism
This is an instruction-only skill with no install spec and no code files; nothing is written to disk or downloaded. That is the lowest-risk install model and is proportionate for a small wrapper skill.
Credentials
The skill itself declares no required environment variables or credentials, which is consistent with being a thin wrapper. However, it depends on the dingtalk-ai-table skill to perform API calls; that dependency will need DingTalk credentials/permissions at runtime. Users should verify that the dependency's credentials are appropriately scoped because this skill will operate on the specific table URL provided (it can add/delete records if the dependency has permission).
Persistence & Privilege
always is false and the skill does not request persistent/privileged installation. It also doesn't modify other skills or agent-wide configuration. Normal autonomous invocation is allowed by platform defaults (no extra concern here).
Assessment
This skill is a narrow wrapper that will call the dingtalk-ai-table dependency to add, remove, or list records in the specific DingTalk table whose URL and IDs are hardcoded in SKILL.md. Before installing, verify: (1) you trust the skill owner and the hardcoded table URL — the skill can modify that table if the dependency's credentials allow it; (2) the dingtalk-ai-table integration/token in your agent has only the minimum permissions required (read/write only to intended tables); (3) you are comfortable with the agent being able to invoke the skill autonomously (default behavior). Also note the small metadata/version mismatch in skill.json vs registry metadata; it’s likely benign but you may want the author to confirm the version.Like a lobster shell, security has layers — review code before you run it.
latestvk97a6yqk4zm0tq501w5qv3dg0983wx2w
License
MIT-0
Free to use, modify, and redistribute. No attribution required.