Security checks across malware telemetry and agentic risk
This fund-analysis skill is mostly purpose-aligned, but it needs Review because it exposes live-looking API credentials and handles sensitive portfolio data with weak storage and export controls.
Install only if you are comfortable with a finance skill that contacts external fund services, stores cache and holdings data locally, and can produce monitoring alerts. Rotate or replace any bundled API key, use your own secrets through environment variables or a secure secret manager, avoid plaintext holdings export, and review/clear the local OpenClaw data files if you process real portfolio information.
# 执行脚本获取命名空间
qieman_ns = {}
with open(scripts_path / "qieman-mcp-query.py", 'r', encoding='utf-8') as f:
exec(f.read(), qieman_ns)
encrypt_ns = {}
with open(scripts_path / "encrypt-holdings.py", 'r', encoding='utf-8') as f:encrypt_ns = {}
with open(scripts_path / "encrypt-holdings.py", 'r', encoding='utf-8') as f:
exec(f.read(), encrypt_ns)
validate_fund_code = qieman_ns['validate_fund_code']
get_cache_key = qieman_ns['get_cache_key']66/66 vendors flagged this skill as clean.