Investment Framework Skill

This skill appears to implement a comprehensive investment analysis toolkit (many expected analysis scripts and docs). However: - Do not run or grant Exec/Bash/Write to this skill until you inspect the scripts. In particular review scripts/auto-publish-clawhub.sh and any scripts referenced by CLAWHUB_CRON_SETUP.md and CLAWHUB_PUBLISH_GUIDE.md — the docs say a publishing token is configured in a script, which could leak credentials or enable automated publishing. - Search the repository for hard-coded secrets (search for 'token', 'TOKEN', 'password', 'KEY', 'APIKEY', 'clawhub login', email addresses). If you find secrets embedded in files, do not use them. - If you intend to use the data-fetching features, prefer configuring API keys in a local user-only config (as the docs suggest) rather than embedding them in repo files. Confirm the code reads keys from that config rather than from checked-in files. - Avoid enabling automatic cron jobs or running publish scripts supplied here; instead run analysis scripts in a sandboxed environment and only after manual review. - If you lack capacity to review all files, consider limiting the skill's allowed tools (disable Exec/Bash/Write) or only allow read-only analysis of its SKILL.md. - If you proceed, audit network calls the scripts make (which external endpoints are contacted) and restrict the agent's network access or run it in an isolated environment. Additional actionable checks that would raise confidence: verify that no file contains hard-coded tokens, confirm auto-publish scripts do not send data to unexpected endpoints, and ensure data sources are public APIs the skill documents (eastmoney, Tencent, AlphaVantage) rather than unknown hosts.