Daxiapi is a financial data API service for the Chinese stock market, providing market breadth, sector relative strength, valuation levels, and stock momentum rankings for bottom-up stock selection. Built on Mark Minervini's VCP, O'Neil's RPS, Wyckoff theory, and price action methodology. This skill should be triggered when users request stock data, market analysis, sector heatmap, momentum data, or other financial metrics.
v3.0.1大虾皮(daxiapi.com)金融数据API服务入口,负责路由分发到具体分析skill。触发词:A股数据、市场数据、股票分析、板块分析、选股、市场复盘。适用场景:获取A股市场数据时的统一入口,根据用户需求分发到对应的专业skill。不适用场景:非A股市场分析、非金融数据分析、纯技术问答。
⭐ 0· 277·0 current·0 all-time
by三水清@ksky521
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match the instructions: the SKILL.md is a routing/front‑end that matches user keywords to specialized analysis skills and provides CLI fallbacks. Required resources in the skill (none) align with that purpose—no unexplained requests for unrelated cloud credentials or system access.
Instruction Scope
Runtime instructions stay within the stated purpose (intent classification, routing to other skills, or providing CLI commands). The SKILL.md does instruct the agent/user to run npx daxiapi-cli@latest commands and to obtain/set a DAXIAPI_TOKEN for API access — these are relevant to the described functionality but imply executing remote code via npm at runtime.
Install Mechanism
There is no install spec and no code bundled with the skill (instruction-only). However the recommended fallback uses npx to fetch/execute daxiapi-cli@latest from npm. That is expected for a CLI workflow but introduces the usual supply‑chain risk of executing code fetched at runtime from a package registry.
Credentials
The skill does not require environment variables or secrets itself. The SKILL.md documents optional use of a DAXIAPI_TOKEN for the daxiapi service (proportional to a data‑API client). There are no demands for unrelated tokens/credentials or access to other config paths.
Persistence & Privilege
Skill is not always-enabled and does not request elevated persistence. It relies on invoking other specialized skills (names listed) and on user-run CLI commands; autonomous invocation is enabled by default but is typical for skills and not by itself problematic here.
Assessment
This skill appears to do what it says: route A‑share data requests to specialist skills and offer CLI fallbacks. Before installing/using: (1) verify the trustworthiness of daxiapi.com and the npm package daxiapi-cli (search the package, author, and versions) because the SKILL.md recommends running npx which will execute remote code; (2) only provide the DAXIAPI_TOKEN to the official daxiapi service and avoid reusing other secrets; (3) consider whether you want the agent to invoke this skill autonomously — not required but increases its blast radius; and (4) if you will run the npx commands, prefer auditing the package or installing a pinned, reviewed version rather than always using @latest.Like a lobster shell, security has layers — review code before you run it.
latestvk9772en84sgfyps89jnxnq486h84cggr
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
