Stock/Industry Tracker
v1.0.1依托东方财富数据库，面向行业或个股，产出跟踪类报告（含日报/周报/月报、研报及结构化跟踪解读）。 满足以下任一条件即触发：（1）用户明确索要「报告」「研报」「跟踪分析」或定期跟踪类文稿；（2）用户点名的行业、板块、指数、个股（名称或代码），并期望系统化、可成文的近况跟踪或梳理。 典型说法如「写一份 XX 行业报告...
⭐ 2· 6.5k·4 current·4 all-time
byFinancial AI Analyst@financial-ai-analyst
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (industry/stock tracking using 东方财富) match the implemented behavior: the script posts the user's query to an EastMoney API endpoint and returns a report/attachments. Required EM_API_KEY is expected for this integration.
Instruction Scope
SKILL.md instructs the agent to pass the raw user query to the included script and synchronously await stdout. The script posts only {"query": ...} to the remote API and decodes base64 attachments to local files. This means user queries (and any sensitive text they include) will be transmitted to the external EastMoney service and attachments will be written to disk as local files — this is expected for a remote-reporting skill but is a privacy exposure users should understand.
Install Mechanism
Instruction-only skill with one bundled script; there is no install step or third-party download. No code-obfuscation or suspicious install behavior present.
Credentials
Declared required env var EM_API_KEY aligns with the API key used in the script. The code also supports an undocumented override env INDUSTRY_STOCK_TRACKER_OUTPUT_DIR to change where attachments are saved; SKILL.md did not document this variable — minor documentation mismatch. No other credentials or unrelated env vars are requested.
Persistence & Privilege
always:false and no special privileges requested. The skill writes attachments to a local directory (default cwd/miaoxiang/industry_stock_tracker) but does not modify other skills or system configs. It uses a long network timeout (1200s) and performs synchronous blocking calls as required by SKILL.md.
Assessment
This skill will send the exact user query text to an external EastMoney report API (so avoid including secrets in prompts) and may write returned PDF/DOCX files to disk under the current working directory (or a directory override via INDUSTRY_STOCK_TRACKER_OUTPUT_DIR, which is supported by the script but not documented in SKILL.md). You should only install if you trust the external service and are comfortable with report content and any prompt data being transmitted off your machine. If you need to limit disk writes, run the skill in a controlled working directory or set INDUSTRY_STOCK_TRACKER_OUTPUT_DIR to a safe location. If you want the skill to be fully auditable, confirm EM_API_KEY scope and retention policies with the service provider.Like a lobster shell, security has layers — review code before you run it.
latestvk97b76nfj8tvs65rgm7ayc7n25845gd9
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
EnvEM_API_KEY