Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed finance-news summary skill with optional Feishu scheduled delivery; the main issues are documentation clarity, not hidden or malicious behavior.
Install only if you want finance summaries and, if enabled, recurring Feishu messages. Review the Feishu destination before scheduling because pushed summaries may be visible to channel members or workspace administrators; expect minor documentation ambiguity around summary length and item count.
The manifest describes the skill as '浓精简（3条精华）' and positions it as more refined than the base finance skill. However, the file later states that manual mode outputs a '完整版' full report and that scheduled push content contains 5-7 items, which materially exceeds the claimed concise 3-item scope.
The skill instructs users to configure scheduled delivery to Feishu without clearly warning that generated finance summaries and any associated account/channel metadata will be transmitted to an external messaging platform. This can cause unintentional disclosure of user preferences, scheduling patterns, or potentially sensitive business/market-monitoring information, especially in workplace contexts.
文档直接给出 openclaw cron rm 删除定时任务的命令，但未对其效果做任何提示。虽然这是技能预期功能的一部分，仍建议在 markdown 中明确说明该操作会删除已有自动推送配置，避免用户误删。
The push format section says daily pushes contain 5-7 highlights within 500 characters, while the '重要提示' section later says messages are controlled within 300 characters. These statements describe conflicting intended behavior for the same output mode.
No suspicious patterns detected.
