jun-invest-option-master-agent

OpenClaw Agent App Installer: install/upgrade & register the jun-invest-option-master-agent isolated agent workspace. Includes auto backup/versioning to Claw...

Security Scan

The package is largely what it claims (an installer + isolated investment agent workspace) but contains hard-coded user paths, unpinned dependency pulls, automatic git → sync → publish automation (launchd + hooks) and network fetches that could inadvertently publish local data or pull/execute remote code; review before running.

Purpose & Capability

Most required behavior matches the description: installer creates an isolated workspace, installs git hooks, and sets up automated publish/sync to ClawHub; data adapters for broker (Futu) and public fallbacks (stooq, yfinance) are expected for a market-data-driven agent. However the SKILL.md and many files hard-code the path /Users/lijunsheng/.openclaw/workspace-jun-invest-option-master-agent, which is specific to one user and not portable; that is unexpected for a general installer and could cause accidental writes or misconfiguration on other systems. Also dependencies are intentionally not pinned and the installer runs 'clawhub update --force' (best-effort pull latest) — reasonable for a dev workflow but increases supply-chain risk.

Instruction Scope

Runtime instructions (SKILL.md + AGENTS.md) direct the agent to create the workspace, enable local git with a post-commit hook that triggers sync/publish, install a macOS launchd job for periodic publish, and run 'clawhub update/publish' plus 'openclaw agents add'. These steps legitimately belong to an installer, but they also read/write local repo state and push artifacts to ClawHub automatically. If the workspace contains sensitive files (or the installer pulls code into runtime), this can result in unintended data publication or code execution. The instructions assume existing clawhub/openclaw credentials/config and give the agent autonomy to perform these actions (the skill can be invoked autonomously by default).

Install Mechanism

There is no formal install spec (instruction-only), but many bundled scripts (auto-install.sh, install.sh, sync-runtime-to-artifact.sh, setup-launchd.sh) will be written/run if the user invokes them. The installer uses 'clawhub update --force' to fetch latest skill dependencies without pinned versions, which is a dynamic network fetch/pull of code (supply-chain risk). No downloads from obscure URLs were observed in the inspected files, and public adapters use standard endpoints (stooq, yfinance).

Credentials

The skill declares no required environment variables or credentials, but it assumes use of existing ClawHub/OpenClaw authentication and a local Futu OpenD endpoint (127.0.0.1:11111). Because it attempts to run publish/update operations that will use whatever credentials/config exist on the host, the skill can cause network actions using your existing auth context without explicitly requesting new credentials. The lack of explicit credential prompts makes it easier to accidentally publish local content.

Persistence & Privilege

The installer intends to install a macOS launchd job and git post-commit hooks to automatically sync and publish artifacts on a schedule or upon commits. That creates persistent background actions that will push content out of the host. The skill itself is not 'always: true', but the installation grants long-lived persistence and automated publishing capability to the installed artifacts/scripts (high blast radius if misconfigured).

What to consider before installing

What to consider before installing: - Don't run this on your main workstation without inspection. The installer will create a workspace under ~/.openclaw (note: files are hard-coded to /Users/lijunsheng/..., which is suspicious if that's not your username). Verify and edit paths in scripts before running. - Review scripts first: open scripts/auto-install.sh, scripts/install.sh, scripts/sync-runtime-to-artifact.sh and setup-launchd.sh to see exactly what they write, commit, and publish. Pay special attention to any lines that add git hooks, run 'clawhub publish', or copy files from other locations. - Before running automatic hooks/publishers, ensure the workspace does not contain secrets (API keys, credentials, private config). The code mentions automatic git commit → sync → ClawHub publish; that can exfiltrate files unintentionally. - Prefer manual mode initially: run scripts step-by-step and inspect changes rather than allowing automated post-commit hooks / launchd. Consider disabling the auto-publish parts (comment out hook installation and launchd setup) until you are confident. - Supply-chain note: the installer runs 'clawhub update --force' and leaves dependencies unpinned. That will pull the latest remote code at install time; consider pinning versions or reviewing the remote slugs listed in skills.lock.json before allowing automatic updates. - If you use Futu OpenD, confirm it should run on 127.0.0.1:11111 and that you expect the adapter behavior. Public fallbacks (stooq/yfinance) will make outbound HTTP requests to fetch market data — expected behavior. - If you are not the person named in the files (lijunsheng / shengge / "生哥"), treat hard-coded identities and paths as red flags and either adapt them to your environment or avoid installation. - Safer approach: test inside a disposable VM/container or isolated account, or run with a user that has minimal credentials and no ClawHub auth, then selectively enable publishing after full review.

jun-invest-option-master-agent — Agent App (Installer + Backup)

这是一个 OpenClaw 独立 agent（isolated workspace） 的安装器 + 自动备份发布闭环。

约定（第一性原则）

• 运行环境（唯一真源）：/Users/lijunsheng/.openclaw/workspace-jun-invest-option-master-agent
• 发布工件（用于发布到 ClawHub 的 skill 资产）：本 skill 目录下的 agent/
• skills 依赖：安装在 OpenClaw 全局 skills 目录；不锁版本，始终 best-effort 拉最新。
• 提交/发布不打扰你：Growth 负责 commit；commit 自动同步到发布工件；后台任务定时发布到 ClawHub。

使用（对话入口）

对我说：

• “安装/升级 jun-invest-option-master-agent（不绑定channel）”

命令行（可选）

bash scripts/auto-install.sh

它会：

1. clawhub update jun-invest-option-master-agent --force
2. 首次创建运行环境（若不存在）
3. 在运行环境启用本地 git + 安装 post-commit hook（commit 触发同步）
4. 安装/加载 macOS launchd 定时发布任务（每天一次 + 轮询重大更新标记）
5. openclaw agents add jun-invest-option-master-agent ...

重大更新立刻发布（Growth 用）

在运行环境创建空文件：

• ~/.openclaw/workspace-jun-invest-option-master-agent/.publish-now

后台轮询会自动发布并清除标记。