Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
uwillberich
v1.0.1Build next-session A-share game plans from market structure, overnight macro shocks, policy timing, and watchlist leadership. Use when the user asks what A-s...
⭐ 0· 86·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description align with included code: the scripts collect Eastmoney/Tencent data, build briefs, run screens, and generate watchlists. Requiring an Eastmoney API key (EM_API_KEY) and calling Eastmoney/Tencent/MX endpoints is coherent for the stated purpose. However, the registry metadata claims no required env vars while README and SKILL.md repeatedly state that EM_API_KEY is mandatory — this mismatch is inconsistent and should be corrected.
Instruction Scope
The SKILL.md instructs the agent to run local Python scripts that fetch market snapshots, poll RSS feeds, build briefs, and write outputs into a local state directory (~/.uwillberich/data/ and news-iterator state). Those actions (network requests to public RSS, Eastmoney/Tencent/MX APIs; local JSON/SQLite outputs) are within scope of the claimed functionality. The instructions do include installing and running a persistent news iterator (continuous loop or launchd), which is expected for a news‑polling feature but is a significant behavior to be aware of.
Install Mechanism
There is no platform install spec (no downloads or package installs), which reduces installer-level risk. All code is bundled in the skill. The README references ./install_skill.sh and provides git clone instructions; there are no suspicious external download URLs in the manifest. The existence of a launchd installer script means the skill can set up a scheduled local job if you run it — review that script before running.
Credentials
The skill's own documentation and SKILL.md require EM_API_KEY (Eastmoney) and the runtime helper enforces it; this is proportionate to the purpose. However, the registry metadata declares no required environment variables — an inconsistency that may lead the platform or users to underestimate the need to supply a service credential. No unrelated credentials are requested in the codebase, but you should confirm what EM_API_KEY gives access to and how it should be scoped/stored (the README suggests ~/.uwillberich/runtime.env).
Persistence & Privilege
always:false (good) and allow_implicit_invocation is enabled in agents/openai.yaml, so the agent may invoke the skill autonomously. The skill contains scripts that can run continuously (news_iterator.py loop) and an installer for a macOS launchd job to schedule polling. Those behaviors are consistent with the advertised persistent news‑iterator feature, but they grant the skill the ability to run background network activity and write local state under your account if you (or an agent acting with sufficient permissions) run the installer. This is expected for a news poller but should be an explicit consent point for users.
What to consider before installing
What to check before installing or running this skill:
- The README and SKILL.md say the skill hard-requires an EM_API_KEY (Eastmoney). The registry metadata does not list any required env vars — treat that as incorrect. Only install if you are willing to provide and store that key locally (the README suggests ~/.uwillberich/runtime.env).
- Inspect scripts/runtime_config.py, scripts/mx_toolkit.py, and scripts/mx_api.py to understand how the EM_API_KEY is used and whether it is transmitted to mkapi2.dfcfs.com or other endpoints. Confirm you trust those external endpoints (mkapi2.dfcfs.com, push2.eastmoney.com, qt.gtimg.cn, public RSS feeds) and the data they return.
- Review the news iterator and launchd installer before using them. If you do not want background polling, do not run scripts/install_news_iterator_launchd.py or the news_iterator.py loop mode. The iterator writes state to ~/.uwillberich/news-iterator/ and creates SQLite/jsonl/md files.
- Because the skill allows implicit invocation by agents, be aware an agent could call its scripts autonomously if the agent is configured to do so. If you want to avoid autonomous network activity or persistent jobs, either disable implicit invocation for this skill in your agent, or run the skill only in an isolated/local environment.
- As a simple safety step, run the provided smoke_test and run scripts in a sandbox or under a user account you control. Verify what files are created and what external hosts are contacted before giving the EM_API_KEY or installing any scheduled jobs.
If you want, I can: (1) point to the specific lines in scripts/install_news_iterator_launchd.py and scripts/news_iterator.py that create persistence/network calls, (2) list every external domain contacted by the code, or (3) help craft a minimal local wrapper that runs only one-off scripts (no launchd/no loop) so you can use the skill without persistent polling.Like a lobster shell, security has layers — review code before you run it.
a-sharevk976whrdj0mvb6v9qjzzfvphex838j49chinavk976whrdj0mvb6v9qjzzfvphex838j49financevk976whrdj0mvb6v9qjzzfvphex838j49latestvk976whrdj0mvb6v9qjzzfvphex838j49marketsvk976whrdj0mvb6v9qjzzfvphex838j49
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📈 Clawdis
Binspython3