Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Capital Flow Analysis
v1.0.0Analyzes stock capital flows including main force net inflows, northbound holdings, and trading leaderboard data for informed investment decisions.
⭐ 0· 391·4 current·4 all-time
by@gbabyzs
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The code implements analyze_main_force and analyze_northbound which align with the skill's stated purpose (主力资金 and 北向资金). However, the skill manifest (skill.json exports) and SKILL.md advertise 龙虎榜/dragon_tiger_list functionality that is not implemented in capital_flow.py — an explicit mismatch between described capability and provided code.
Instruction Scope
SKILL.md instructions and examples are narrowly scoped to calling the two implemented functions and list reasonable data sources (东方财富, 沪深港通, 交易所龙虎榜). The instructions do not ask the agent to read unrelated files, environments, or send data to unexpected endpoints.
Install Mechanism
There is no install spec but the manifest declares dependencies (akshare, pandas). This likely implies pip installation at runtime; akshare will perform network requests to fetch market data. No arbitrary URL downloads or extracted archives are present in the package, which lowers install risk, but installing dependencies from PyPI can still pull many transitive packages — reasonable for a Python data skill but worth noting.
Credentials
No environment variables, credentials, or config paths are requested. The skill does not require sensitive tokens for its stated data sources, so requested access is proportionate.
Persistence & Privilege
The skill does not request always:true and makes no modifications to other skills or system-wide settings. Agent autonomous invocation is allowed by default (disable-model-invocation:false) which is normal for skills and not, by itself, a red flag.
What to consider before installing
This skill appears to honestly implement main-force and northbound capital-flow analysis, but it advertises a 'dragon_tiger_list'/龙虎榜 export that is missing from the code. Before installing or relying on it: 1) Verify the missing function — ask the publisher or inspect a newer release; 2) Run the code in an isolated virtual environment so pip can safely install akshare and pandas; akshare will fetch data from external web sources (that's expected); 3) Test the functions with known tickers to confirm column name assumptions and error handling (the code returns exception strings if data fields differ); 4) If you need the 龙虎榜 feature, don't assume it's present — require an update or implement it yourself; 5) If you don't trust the unknown source owner, avoid installing or review the package dependencies and network behavior first.Like a lobster shell, security has layers — review code before you run it.
latestvk97ecrq0q84fcxf5jnjct938f982yv96
License
MIT-0
Free to use, modify, and redistribute. No attribution required.