jy-hk-stock-morning-brief

This skill appears to do what it claims (call a market-data MCP via mcporter and produce reports) but has several practical and security issues you should consider before installing: - Verify package authenticity: the install uses npm install -g mcporter. Confirm the mcporter package is the official tool and trust the publisher before installing globally. - Missing runtime declarations: the code is Python but the skill metadata does not list python/python3 or the Python PDF libraries (weasyprint/markdown/markdown2pdf). You will need to install Python and those packages separately. - Credential handling: the skill requires a JY_API_KEY (described in SKILL.md) but does not declare it as a required credential. The instructions embed the token in service URLs (mcporter config add ...?token=YOUR_KEY). Avoid storing secrets in plaintext files/URLs if possible; prefer using a secure secrets store and review where the token will be saved. - Config and paths: SKILL.md asks you to edit ~/.openclaw/openclaw.json and save reports to a hardcoded /home/liust/... path. Back up your OpenClaw config before making changes and update paths to locations appropriate for your environment. - Command-injection risk: the Python fetch script builds shell commands and runs them with shell=True. If you or other components supply untrusted strings to the script, there is a risk of shell injection. Run the scripts in a controlled environment and inspect/validate inputs. If you want to proceed: review the mcporter package, install Python and required libs in a virtual environment, configure mcporter securely (verify where tokens are stored), change hardcoded paths to safe locations, and run the scripts in an isolated or test environment first. If you prefer, request the publisher to: declare python as a required binary, declare the JY_API_KEY requirement in metadata, avoid embedding tokens in URLs, and avoid shell=True by passing arguments as a list to subprocess.run.