BigA · A股智能选股

AdvisoryAudited by Static analysis on May 13, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A trigger can cause local execution, network lookups, and channel messages without a separate confirmation step for each action.

Why it was flagged

The skill directs the agent to run a local script, perform web searches, and send messages as part of the stock-analysis workflow.

Skill content
用户手动触发 ... 执行 `python3 scripts/biga-scan.py --segments` ... web_search ... 逐段 `openclaw message send` 发送
Recommendation

Use it only when you want automated stock scans and message delivery; ask the agent to confirm before sending or installing if you want stricter control.

What this means

After installation, the skill can continue running on a schedule and sending market messages to the configured channel.

Why it was flagged

The included cron template installs recurring autonomous sessions for morning, intraday, and closing stock alerts.

Skill content
openclaw cron add --name biga-morning --cron "30 8 * * 1-5" ... --session isolated
Recommendation

Install only if you want recurring alerts, and know how to review or remove the created OpenClaw cron jobs if you change your mind.

What this means

Stored watchlists and preferences can shape future recommendations, and inaccurate or stale entries could affect recurring signals.

Why it was flagged

The skill uses persistent watchlist/preference context and may automatically modify the stock pool based on its scoring rules.

Skill content
读 `workspace/memory/biga-stock-pool.md` ... `references/user-preferences.md` ... 动态维护≤30支,超额自动淘汰
Recommendation

Review the stock-pool and preference files periodically, and avoid storing sensitive portfolio details there if you do not want them reused.

What this means

It is slightly harder to verify exactly which package version was reviewed or installed.

Why it was flagged

The bundled _meta.json version differs from the supplied registry version 5.2.10, which is a minor provenance/versioning inconsistency; no unsafe installer or hidden dependency is shown.

Skill content
"version": "5.2.8"
Recommendation

Prefer installing from the trusted registry entry and re-check the bundled files after updates.