Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

A Stock Paper Trade

v1.0.0

A股模拟炒股系统。支持实时行情查询、买卖下单、持仓管理、盈亏计算、涨跌排行、K线查看。触发词:炒股、买入、卖出、持仓、盈亏、行情、涨停、跌停、选股、大盘。

0· 134·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (A股模拟炒股) matches what the code does: realtime quotes, buy/sell simulation, positions, K-line using akshare and Sina HTTP API. It reads/writes a portfolio file under ~/.openclaw/paper-trade which is coherent with a local paper-trade tool. Minor mismatch: SKILL.md's quickstart says initializing with 1,000,000 virtual cash but the script sets INITIAL_CASH = 50_000 (50k).
Instruction Scope
SKILL.md instructs running the included Python script and activating a virtualenv path (~/.agent-reach-venv), and all runtime operations are limited to local portfolio files and network calls to public market data endpoints. However, the instructions do not document required Python packages (the script imports requests and akshare), and the provided file contents appear truncated/contain a coding bug near the sell/profit computation (undefined/partial variable), which may cause runtime failures or unexpected behavior.
!
Install Mechanism
No install spec is provided. The script depends on third-party Python packages (requests, akshare) but SKILL.md doesn't declare or install them. The quickstart implies a specific virtualenv (~/.agent-reach-venv) that is not created or managed by the skill. Missing dependency management is a deployment risk (the agent or user must install packages manually), and the lack of a reproducible install step is a usability and supply-chain concern.
Credentials
The skill declares no environment variables or credentials and does not attempt to access unrelated config or secrets. It stores data under the user's home directory (~/.openclaw/paper-trade) which is reasonable for a local paper-trade tool. Network access to public quote endpoints (hq.sinajs.cn and akshare data sources) is required and expected for its function.
Persistence & Privilege
always is false and the skill only writes to its own portfolio path under ~/.openclaw; it doesn't request system-wide privileges, modify other skills, or require persistent inclusion. Autonomous invocation (disable-model-invocation=false) is the platform default and not by itself a red flag.
What to consider before installing
Things to consider before installing/using this skill: - The script requires Python packages (requests and akshare) that are not declared or installed automatically. Install them in an isolated virtualenv before running (pip install requests akshare). The SKILL.md's example activates a virtualenv (~/.agent-reach-venv) but the skill does not create it. - There is a clear inconsistency: SKILL.md says initializing with 1,000,000 virtual funds, while the script sets INITIAL_CASH = 50,000. Expect the code value (50k) unless you inspect and change it. - The provided file contents appear truncated and there is evidence of a coding error near the sell/profit logic (an undefined/partial variable). Review the full script for correctness before trusting financial calculations and backups. - The tool stores portfolio data at ~/.openclaw/paper-trade/portfolio.json. Backup that file if it already exists and review file permissions. - The script fetches market data from public endpoints (hq.sinajs.cn and akshare). These are expected for this skill; they are network calls to third-party servers. If you require strict privacy, evaluate network access policies. - Recommended steps: inspect the full scripts locally, run them in a freshly created isolated virtualenv, install required packages, run python3 scripts/trader.py init to confirm behavior, and test buy/sell flows with small synthetic operations to confirm calculations and that no runtime exceptions occur. If you are not comfortable reviewing Python code, avoid installing until the owner/publisher provides a documented install step and fixes the code inconsistencies.

Like a lobster shell, security has layers — review code before you run it.

latestvk9747dzrcsckgrc4z9fd14e0bn83j5dj

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

OSmacOS · Linux · Windows
Binspython3

Comments