Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Wyckoff Diagnose
v1.2.0Wyckoff 2.0 诊股系统。输入任意A股代码，输出完整分析报告（Phase状态、Volume Profile关键价位，综合评分、评级、操作建议）。支持右侧趋势🅡和左侧积累🅁双视角诊断。当用户要求"诊股"、"分析股票"、"帮我看看XXX"、"这个股怎么样"、"诊断"时触发。支持输入6位股票代码。
⭐ 0· 105·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill claims to fetch data via efinance in SKILL.md, but the runtime code tries three sources in order (tushare → baostock → efinance). Including multiple data adapters is plausible for robustness, but the SKILL.md does not document the tushare adapter or the use of a custom remote endpoint. The presence of a hardcoded Tushare token and custom HTTP URL in ts_data.py is not justified by the README and is disproportionate to a simple analysis task.
Instruction Scope
SKILL.md describes pulling daily data (mentions efinance) and computing indicators. The code follows that workflow, but it also will send requests to an externally hosted Tushare-compatible service (ts_data._http_url = 'http://140.143.209.128:5000') using an embedded token. The instructions do not warn that queries (stock codes, dates) may transit an unvetted remote server, which broadens the skill's runtime scope beyond what the documentation states.
Install Mechanism
There is no install spec (no archive downloads). That's lower risk. However, the shipped Python scripts require several third‑party packages (tushare, efinance, baostock, scipy, pandas) that are not declared anywhere; running the skill will attempt network I/O to third‑party APIs. No arbitrary remote downloads are present in the package itself.
Credentials
The skill declares no required environment variables or credentials, yet ts_data.py embeds a long Tushare token and overrides the API HTTP URL to an IP address. Hardcoding a credential and pointing to an unlisted IP is disproportionate and suspicious — it effectively delegates data access (and visibility into queries) to a third party without informing the user or requesting their own API key.
Persistence & Privilege
The skill is not marked always:true, does not request system-level config paths, and does not modify other skills. It appears to run only when invoked and does not persist changes to broader agent configuration.
What to consider before installing
Caution: the code includes a hardcoded Tushare token and a custom API host (http://140.143.209.128:5000). That means your stock-code queries would be routed (and visible) to that remote server using the embedded credential. Before installing or running: 1) inspect ts_data.py and consider removing or replacing the hardcoded TOKEN/_http_url; 2) prefer configuring your own TUSHARE token via an environment variable and using the official Tushare endpoint; 3) if you can't validate the remote host, run the skill in a network‑restricted sandbox or block outbound access to that IP; 4) ask the publisher to explain why a private HTTP host is used and to update SKILL.md to document all data sources and required credentials. If you need a safe quick test, edit diagnose.py to force it to use only efinance or baostock (remove/disable ts_data usage) so queries do not go to the unknown endpoint.Like a lobster shell, security has layers — review code before you run it.
latestvk979vcyp9gfw9q0py9yt0exdts83q1rg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.