Financial Risk Scanner for Listed Companies

What to check before installing or running this skill: - Metadata mismatch: the registry metadata claims no required env vars but SKILL.md and the code require a TUSHARE_TOKEN. Do not assume the skill needs no credentials — it does. Ask the publisher to correct the registry metadata. - TUSHARE_TOKEN is sensitive: it grants access to a paid data API tied to your account. Use a dedicated/limited API token (or trial account) rather than your primary account token. Monitor API usage/quota to avoid unexpected charges. - Inspect the repo yourself (you have the Python files). The code is readable and the network calls are to tushare.pro via the tushare client; there are no obvious obfuscated endpoints. If you are not comfortable reading code, run it in an isolated environment (VM or container) and with a test token first. - Files written to disk: reports are saved under ~/.openclaw/workspace/memory/financial-risk/. If you are concerned about data persistence or leakage, change the output path or run in a disposable environment. - API quota and batch mode: example scripts include batch analysis and loops over peer lists — these can consume large numbers of API calls. If you run batch analyses, throttle requests and watch your Tushare rate limits/quotas to avoid denial-of-service or unexpected billable usage. - Trust and provenance: the skill source and homepage shown in the registry are minimal/unknown. Prefer skills with a verifiable homepage, published repository, or known author. Ask the owner for source repository link or sign-off. If the owner provides corrected registry metadata (listing TUSHARE_TOKEN) and a verifiable homepage or repository, the inconsistencies would be resolved and confidence in the package would increase. If you can't validate the publisher, run the code only in a sandbox and use a token with limited access.