Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Stock Price Query MX

v1.1.4

实时股票行情查询,支持 A 股、港股、美股及大盘指数,支持批量查询。无需 API Key。Real-time stock & index quotes for A-shares, HK & US markets. Batch supported.

0· 60·0 current·0 all-time
byLiuLi@liuli4

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for liuli4/stock-price-query-mx.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Stock Price Query MX" (liuli4/stock-price-query-mx) from ClawHub.
Skill page: https://clawhub.ai/liuli4/stock-price-query-mx
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: python3
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install stock-price-query-mx

ClawHub CLI

Package manager switcher

npx clawhub@latest install stock-price-query-mx
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The description claims 'no API Key' and 'zero dependencies', but the included scripts try to obtain an EM_API_KEY (from env or from /root/.openclaw/workspace/vault/credentials/eastmoney.json) and call an external mx-finance-data script under /root/.openclaw/workspace/skills/.... Accessing a vault file and another skill's scripts is not required for a simple public-API stock query and does not align with the 'no API Key / zero-dependency' claim.
!
Instruction Scope
SKILL.md instructs running the included script in the skill dir, but the script's runtime behavior expands scope: it spawns subprocesses that run /root/.openclaw/workspace/skills/mx-finance-data/scripts/get_data.py, parses stdout to find file paths and then reads Excel files and (optionally) pandas output. The script also tries to read a credential file from the platform vault. These actions access platform-internal paths and other skills' artifacts beyond the described functionality.
Install Mechanism
No install spec (instruction-only) so nothing is downloaded at install time — lower install risk. However, runtime imports (pandas, reading Excel) are required but not declared, so execution may fail or pull in packages at runtime. The use of subprocess to execute other workspace scripts increases runtime dependencies and risk.
!
Credentials
The skill declares no required env vars, but the code reads EM_API_KEY from the environment and, if absent, attempts to read a credentials JSON from the platform vault path. Requesting or accessing an internal vault file and passing EM_API_KEY into subprocesses is disproportionate to a 'no-API-key' stock price tool and raises risk of secret access/exfiltration.
!
Persistence & Privilege
always:false (good), but the script directly invokes another skill's script via an absolute path in the shared workspace and reads files from the workspace/vault. While it doesn't set 'always' or alter other skills' configs, accessing other skills' code and platform credential locations crosses containment boundaries and grants more privilege than expected for a query helper.
What to consider before installing
This skill appears to implement real-time stock queries, but there are inconsistencies and risky behaviors you should consider before installing: - The README claims 'no API Key', yet the Python code tries to use EM_API_KEY (from env) or reads /root/.openclaw/workspace/vault/credentials/eastmoney.json. That means it may attempt to access platform-stored credentials without declaring it. Do not install unless you accept that behavior. - The script invokes another skill's script at /root/.openclaw/workspace/skills/mx-finance-data/scripts/get_data.py and then reads Excel files that the other script outputs. That cross-skill access can read or process files outside this skill and could be used to access sensitive workspace data. Ask the author why this cross-skill call is necessary and request that the required functionality be included in this skill or replaced by direct, documented API calls. - The skill uses pandas and reads Excel files but lists only python3 as a required binary. Verify that the runtime environment has needed Python packages, or that a safe install plan is provided. - If you must use it: run the skill in a restricted/sandboxed agent environment that prevents access to /root/.openclaw/workspace and the vault, or inspect the external get_data.py file and the eastmoney.json vault contents first. Prefer versions that use only public HTTP APIs (qt.gtimg.cn) without accessing platform vaults or other skills. What would change this assessment: if the publisher provides an explanation showing the mx-finance-data get_data.py is bundled and audited as part of this skill (not an unaudited external script), if the skill is updated to stop reading platform vault paths and instead documents required API keys explicitly, or if the code is modified to only use public APIs and to declare required dependencies (pandas) clearly.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

📈 Clawdis
Binspython3
latestvk9785knctvz326b3b0qf4gkgfd851agb
60downloads
0stars
1versions
Updated 1w ago
v1.1.4
MIT-0

Stock Price Query Skill

实时股票行情与大盘指数查询技能,覆盖 A 股(沪深两市)港股美股三大市场。支持单只查询批量查询(一次查询多只股票对比),轻量无依赖,无需 API Key,适合聊天场景下的快速股价查询——秒级获取当前价格、涨跌幅、开高低收、成交量等行情数据。

Real-time stock quote and market index tool covering A-shares, Hong Kong, and US stocks. Supports batch queries for comparing multiple stocks in one call. Quick chat-friendly price checks with zero dependencies and no API key needed.

Overview

实时股票价格查询技能,支持查询 A 股(沪深两市)、港股和美股的实时行情数据。

数据源策略(v1.1.4 起):

  • A 股/美股: 腾讯财经 API (qt.gtimg.cn) - 准确、实时、无需 API Key
  • 港股: 东方财富妙想数据服务 - 解决腾讯 API 港股延迟问题,提供实时行情

混合数据源策略确保所有市场数据实时准确。

When to Use

当用户的请求涉及以下场景时触发此技能:

  • 查询股价:"茅台多少钱"、"查一下宁德时代"
  • 了解涨跌:"腾讯今天涨了吗"、"00700 行情"
  • 股票代码查询:"600519"、"NVDA price"
  • 多只对比:"比亚迪和英伟达的股价"、"帮我看下茅台、腾讯和苹果"
  • 批量查询:"查一下这几只:600519, 00700, AAPL"
  • 大盘指数:"上证指数多少"、"大盘怎么样"、"恒指行情"
  • 关键词触发:"查股票"、"股票行情"、"stock price"

How to Use

查询流程

  1. 解析用户输入:从用户消息中提取股票代码。如果用户提供的是中文名称,需先根据下方映射表将名称转换为股票代码(脚本仅接受股票代码作为输入)。
  2. 识别市场:根据股票代码格式自动识别所属市场:
    • A 股沪市:以 sh 开头或 6 位数字以 6 开头(如 sh600519600519
    • A 股深市:以 sz 开头或 6 位数字以 0/3 开头(如 sz000001300750
    • 港股:以 hk 开头或纯数字 5 位及以下(如 hk0070000700),港股指数为纯字母代码(如 HSIHSCEI
    • 美股:纯英文字母代码(如 AAPLTSLAGOOGL),美股指数以 . 开头(如 .IXIC.DJI.INX
  3. 执行查询脚本:运行 scripts/stock_query.py 获取实时数据。
  4. 格式化输出:将结果以清晰友好的格式展示给用户。

脚本调用方式

单只查询:

python3 {{SKILL_DIR}}/scripts/stock_query.py <stock_code> [market]

批量查询(推荐用于多只对比):

python3 {{SKILL_DIR}}/scripts/stock_query.py <code1,code2,code3>

参数说明:

  • stock_code(必需):股票代码,如 600519AAPL00700。批量查询时用逗号分隔,最多 20 只。
  • market(可选):市场标识,可选值为 sh(沪市)、sz(深市)、hk(港股)、us(美股)。不提供时脚本会自动识别。批量查询时不需要此参数(自动识别各只股票的市场)。

单只查询输出格式:JSON 对象:

{
  "code": "600519",
  "name": "贵州茅台",
  "market": "sh",
  "current_price": 1688.00,
  "change": 12.50,
  "change_percent": 0.75,
  "open": 1680.00,
  "high": 1695.00,
  "low": 1675.00,
  "prev_close": 1675.50,
  "volume": 2345678,
  "amount": 3956789012.50,
  "time": "2026-02-24 15:00:00",
  "status": "success"
}

批量查询输出格式:JSON 数组,每只股票一个对象:

[
  { "code": "600519", "name": "贵州茅台", "market": "sh", "current_price": 1688.00, "change": 12.50, "change_percent": 0.75, "status": "success", ... },
  { "code": "00700", "name": "腾讯控股", "market": "hk", "current_price": 420.60, "change": 5.20, "change_percent": 1.25, "status": "success", ... },
  { "code": "AAPL", "name": "APPLE", "market": "us", "current_price": 178.50, "change": -1.30, "change_percent": -0.72, "status": "success", ... }
]

常见股票名称与代码映射(供 agent 参考)

脚本仅接受股票代码作为输入,不支持中文名称。当用户提供股票名称时,agent 应先根据下表将名称转换为对应代码后再调用脚本:

大盘指数:

名称代码市场
上证指数/大盘000001sh
深证成指399001sz
创业板指399006sz
恒生指数/恒指HSIhk
国企指数/H股指数HSCEIhk
纳斯达克/纳指.IXICus
道琼斯/道指.DJIus
标普500.INXus

热门个股:

名称代码市场
贵州茅台600519sh
中国平安601318sh
招商银行600036sh
工商银行601398sh
中国石油601857sh
比亚迪002594sz
宁德时代300750sz
五粮液000858sz
美的集团000333sz
腾讯控股00700hk
阿里巴巴09988hk
美团03690hk
小米集团01810hk
京东09618hk
苹果/AppleAAPLus
特斯拉/TeslaTSLAus
英伟达/NVIDIANVDAus
微软/MicrosoftMSFTus
谷歌/GoogleGOOGLus
亚马逊/AmazonAMZNus
Meta/FacebookMETAus

对于不在映射表中的股票名称,提示用户提供准确的股票代码。

输出格式要求

单只查询:查询成功后,以如下紧凑格式展示结果(不要使用表格,避免消息过长导致飞书分页):

📈 **{股票名称}**({股票代码}.{市场})

💰 当前价格:{current_price} 元/港元/美元 | 📊 涨跌幅:{change} ({change_percent}%) ↑/↓
📅 行情时间:{time}
📊 今开 {open} | 最高 {high} | 最低 {low} | 昨收 {prev_close}
📦 成交量:{volume} | 成交额:{amount}

批量查询:多只股票依次展示,每只之间空一行:

📈 **贵州茅台**(600519.SH)
💰 1688.00 元 | 🟢 +12.50 (+0.75%) ↑

📈 **腾讯控股**(00700.HK)
💰 420.60 港元 | 🟢 +5.20 (+1.25%) ↑

📈 **APPLE**(AAPL.US)
💰 178.50 美元 | 🔴 -1.30 (-0.72%) ↓

涨跌幅为正时使用 🟢 和 ↑,为负时使用 🔴 和 ↓。成交额如果超过 1 亿,用"亿"为单位显示(保留两位小数);超过 1 万不足 1 亿,用"万"为单位显示。

Edge Cases

  • 输入安全校验:脚本在执行前会严格校验所有输入参数。stock_code 仅允许字母、数字和前导点号(正则 ^\.?[A-Za-z0-9]{1,10}$,前导点号用于支持美股指数代码如 .IXIC.DJI.INX),market 仅允许白名单值(sh/sz/hk/us)。任何包含特殊字符、shell 元字符或超长输入都会被拒绝,防止命令注入。
  • 批量查询数量限制:一次最多查询 20 只股票,超出时返回错误提示。
  • 批量查询部分失败:批量查询中如果部分股票代码无效,有效的股票仍正常返回结果,无效的会在对应位置返回错误信息。agent 应正常展示成功的结果,对失败的提示用户。
  • 股票代码无效:返回 "无法识别该股票代码,请确认后重试。支持 A 股(6 位数字)、港股(5 位数字)、美股(英文字母)。"
  • 网络请求失败:返回 "网络请求失败,请稍后重试。"
  • 非交易时段:正常返回最近的收盘数据,并提示 "当前为非交易时段,显示的是最近一次的收盘数据。"
  • 股票名称模糊:脚本不支持名称输入。如果用户提供的名称无法在映射表中匹配,agent 应提示用户提供准确的股票代码。
  • API 限流:如遇到限流,等待 1 秒后重试一次,仍失败则提示用户稍后再试。

Comments

Loading comments...