Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Tickflow Realtime
v0.1.0使用 TickFlow 数据中心查询实时行情和日K数据。适用于用户想查单个或多个标的的最新价格、涨跌幅、成交量、交易时段，或查询单标的/多标的的日K、最近N根K线、复权K线时。
⭐ 0· 110·0 current·0 all-time
by@cengsin
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name/description match the included Python scripts: they call TickFlow endpoints for quotes and K-lines and return summaries/tables/JSON. However, the registry metadata lists no required environment variables or primary credential while the SKILL.md and code clearly require an API key (TICKFLOW_API_KEY). This omission is an incoherence between declared metadata and actual capability.
Instruction Scope
SKILL.md and the scripts keep to the stated scope: they read an API key from the environment, call TickFlow endpoints (defaults to https://api.tickflow.org), validate and format responses, and avoid writing the API key to disk or logs. The runtime instructions do not ask the agent to read unrelated files or send data to unexpected endpoints.
Install Mechanism
There is no install spec (instruction-only skill with Python scripts included). Nothing in the manifest downloads or writes remote archives; the code is local and uses standard library urllib for network calls. This is the lower-risk install pattern, but note the repository/source is unknown.
Credentials
The code requires a secret API key via the environment variable TICKFLOW_API_KEY (resolve_api_key raises if missing). Yet the registry metadata did not declare any required env or primary credential. Asking for an API key is reasonable for this purpose, but the metadata omission is a red flag — the skill will fail without the key and the registry listing does not surface that it needs credential input.
Persistence & Privilege
The skill does not request always:true, does not modify other skills or system config, and does not persist credentials itself. It behaves as a normal, user-invoked client script.
What to consider before installing
This package appears to be a straightforward TickFlow HTTP client, but the registry entry is missing the fact that it requires TICKFLOW_API_KEY and the source/homepage is unknown. Before installing or supplying an API key: 1) Verify the skill's origin (repo/owner) and prefer published code from a known source; 2) Inspect the included scripts yourself (they're short and readable) to confirm no hidden endpoints; 3) Provide a least-privilege TickFlow API key (or a scoped/test key) rather than a high-privilege/production key; 4) If you must run it, consider running in a restricted/sandboxed environment and monitor network traffic; 5) Ask the publisher to update registry metadata to declare TICKFLOW_API_KEY as a required credential and to add a homepage/source link — the current metadata omission is the main inconsistency.Like a lobster shell, security has layers — review code before you run it.
latestvk9798fy0c22484hyp32902jz1h839w1k
License
MIT-0
Free to use, modify, and redistribute. No attribution required.