Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Stock AI Analyzer
v2.2.1股票AI分析助手,支持基础分析和增强分析。基础模式:输入"股票名称 基本面/技术面"进行标准分析。增强模式:输入"股票名称,基本面,重点查询分析xxx"可在基础分析上追加深度专题分析。⚠️ 重要提示:1) 需要配置 TUSHARE_TOKEN 才能获取股票数据;2) 需要配置 AI 模型才能进行分析(支持 Ope...
⭐ 0· 422·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The name/description, SKILL.md, and code align: the skill fetches stock data via Tushare, computes financial ratios, and sends analysis prompts to an AI model. The capabilities requested (TUSHARE_TOKEN, model API keys/endpoints) are appropriate for the stated purpose. However, registry metadata lists no required env vars despite the code and README clearly requiring TUSHARE_TOKEN and model credentials — an incoherence between declared metadata and actual needs.
Instruction Scope
SKILL.md and the scripts describe and implement a focused workflow: read Tushare data (from env or .env in current dir), compute analyses, and send prompts and data to a configured AI model endpoint. The instructions explicitly warn that stock/financial data is sent to the AI service. The code does not attempt to read unrelated system paths or credentials.
Install Mechanism
There is no install spec (the skill is 'instruction-only' at registry level) but the bundle includes multiple Python scripts with external dependencies (tushare, pandas, numpy). This is low-risk relative to arbitrary remote downloads, but the absence of an install mechanism means the user must manually install dependencies; the presence of executable code should be noted by the user.
Credentials
The code legitimately requires TUSHARE_TOKEN and various AI-model credentials (OPENAI_API_KEY / OPENAI_BASE_URL, LLM_API_KEY / LLM_API_BASE / LLM_MODEL, OPENCLAW_MODEL_ENDPOINT, OPENCLAW_SESSION). That is proportionate to the functionality. The problem: the registry metadata claims 'Required env vars: none', which is inaccurate and could mislead users into under-protecting secrets. Also the data_fetcher will read a .env file in the current working directory (but not parent dirs), which users should be aware of.
Persistence & Privilege
The skill does not request always:true, does not attempt to modify other skills or system-wide configs, and does not request persistent privileges. It only uses runtime environment variables and performs network calls to configured AI endpoints and Tushare API.
What to consider before installing
This package mostly does what it claims (fetch Tushare data, compute ratios, and send analysis prompts to an AI model). Key points before installing/using:
- Metadata mismatch: the registry lists no required env vars, but the SKILL.md and code require TUSHARE_TOKEN and an AI model configuration (OPENAI_API_KEY or LLM_* or OPENCLAW_MODEL_ENDPOINT). Do not assume no secrets are needed.
- Secrets handling: provide TUSHARE_TOKEN and any model API keys only to trusted environments. The skill will send stock and financial data (and the constructed prompts) to whichever AI endpoint you configure — ensure that endpoint is trusted and that sending this data is acceptable.
- .env behavior: the data fetcher will read a .env file in the current working directory for TUSHARE_TOKEN if ENV not set. Ensure you do not leave sensitive tokens in world-readable files in that directory.
- Dependencies and execution: the bundle contains Python scripts that import tushare, pandas, numpy; you'll need to install these yourself. Review the code locally before running and run in an isolated environment if you are unsure.
- Provenance: the skill's source/homepage is unknown. If you require higher assurance, ask the publisher for a homepage or source repository, or review the full code locally and run in an isolated environment.
If you proceed, set only the minimal required env vars in a controlled environment, confirm the AI endpoint is trusted, and inspect the scripts yourself (especially network-calling ai_client.py and data_fetcher.py) before running.Like a lobster shell, security has layers — review code before you run it.
latestvk97dr1fqf7hmf1ynyhvqa7n7fd834r9w
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
