ClawHub

Stock Simulator

v1.0.2

模拟炒股技能。当用户想要模拟炒股、学习投资、记录股票交易、查看股票收益时使用此技能。支持A股、港股、美股市场，提供股票推荐、购买记录、收益计算等功能。

⭐ 0· 181·1 current·1 all-time
by@kingdevatil
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name/description (模拟炒股) match the instructions: simulate trades, recommend stocks, record transactions, calculate profits. Required runtime (Python, network) and data files under workspace/stock_data/{用户ID}/ are proportionate to this purpose.
ℹ
Instruction Scope
SKILL.md instructs creating a local Python script that fetches data from public endpoints (eastmoney, gtimg, Yahoo) and the skill stores state under workspace directories. This is within scope, but the recommended proxy configuration requires editing the script (comment/uncomment) which could lead users to hardcode credentials; the skill will perform network calls to third-party endpoints as part of normal operation.
✓
Install Mechanism
Instruction-only skill with no install spec or downloaded code. No installers or archives are fetched; lowest install risk.
ℹ
Credentials
The skill declares no environment variables or credentials, which matches its use of public APIs. Caveat: the guide suggests adding a PROXY mapping inside the script file (not as an env var), which could encourage hardcoding of proxy credentials into workspace files—this is a security/privacy risk for the user to manage.
✓
Persistence & Privilege
always:false and no system-wide changes requested. The skill creates files only under workspace/ (its own data and scripts), not system configuration or other skills' settings.
Assessment
This skill appears internally consistent for a stock simulator, but the source is unknown—before installing or running: (1) inspect the provided get_market_data.py and any other files the skill will create; do not hardcode proxy credentials or secrets into those files; (2) run the data-fetching script manually in a safe environment to confirm it only queries the listed public endpoints (eastmoney, gtimg, Yahoo); (3) be aware the skill will create workspace/stock_data/{用户ID}/ and workspace/skills/stock-simulator/scripts/ files—store them where you want and back them up if needed; (4) if you need a proxy, prefer configuring it via environment or a secure config mechanism rather than embedding credentials in the script; (5) if you do not trust the publisher, run in a sandbox or decline installation.

Like a lobster shell, security has layers — review code before you run it.

latestvk976jf6hvrwzhj03h2zpp6vcfd834vky

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments