ClawHub

Industry Research Agent

v1.0.2

依托东方财富数据库，为指定行业生成深度研究报告。 当用户问题中出现可识别的行业/产业/领域主体，且意图属于行业认知、产业剖析或撰写研究报告时，应触发本 Skill。 常见表述如「XX 行业研究」「XX 行业报告」「帮我分析 XX 行业」「XX 产业深度研究」「XX 领域市场分析」等。 即使用户未明说「报告」，只要...

⭐ 3· 6.7k·6 current·6 all-time
byFinancial AI Analyst@financial-ai-analyst
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description claim to rely on 东方财富 (EastMoney) data; the code posts to an EastMoney-related endpoint and requires only EM_API_KEY. No unrelated credentials, binaries, or surprising capabilities are requested.
✓
Instruction Scope
SKILL.md instructs the agent to extract a topic and call scripts/get_data.py synchronously; the script only reads the provided query and environment vars, calls the external API, decodes returned base64 attachments, and writes files. It does not read other files, secrets, or system state.
✓
Install Mechanism
No install script that downloads arbitrary code is present. The skill requests a single Python dependency (httpx) via pip, which is proportionate to performing an HTTP call.
✓
Credentials
Only EM_API_KEY is required, which matches the script's use as an API key sent to the EastMoney endpoint. No extra unrelated environment variables or secret patterns are requested.
✓
Persistence & Privilege
Skill is not always-enabled, does not modify other skills or system settings, and only writes output files to a configurable directory it documents. Autonomous invocation defaults are unchanged.
Assessment
This skill appears coherent, but before installing: 1) Verify EM_API_KEY is the correct, minimal-scope credential for the EastMoney service and use a dedicated key (do not reuse broader keys). 2) Confirm you trust the endpoint domain (https://ai-saas.eastmoney.com/...) because your query text and API key are sent there. 3) Set INDUSTRY_RESEARCH_REPORT_OUTPUT_DIR to a controlled directory and inspect downloaded PDF/DOCX files before opening. 4) Be aware the script writes files and decodes base64 content—treat attachments like any externally generated files. 5) If you need higher assurance, ask the publisher for a homepage or provenance info and review network calls in a controlled environment.

Like a lobster shell, security has layers — review code before you run it.

financialvk972py9dz5fpwpbdt96stwtpcx84kjkflatestvk972py9dz5fpwpbdt96stwtpcx84kjkfmarcovk972py9dz5fpwpbdt96stwtpcx84kjkfresearchvk972py9dz5fpwpbdt96stwtpcx84kjkfsectorvk972py9dz5fpwpbdt96stwtpcx84kjkf

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

EnvEM_API_KEY

Comments