Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
LongbridgeAssistant
v1.0.0长桥证券智能投资助手。自动监控持仓、生成投资组合可视化图表、智能止盈止损提醒。Use when: user asks about 长桥持仓、投资组合分析、止盈止损、股票监控、portfolio analysis、price alerts. Features: 实时获取49+只股票持仓、港股/美股分开可视化、价格触...
⭐ 0· 46·0 current·0 all-time
byJaysonDing@p3dp
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description require Longbridge API access and the files/scripts require the longbridge Python SDK and matplotlib. The required env vars (LONGBRIDGE_APP_KEY, LONGBRIDGE_APP_SECRET, LONGBRIDGE_ACCESS_TOKEN) and python3 binary are consistent with the stated purpose.
Instruction Scope
Runtime instructions and scripts instruct the agent to read and source ~/.longbridge/env and to run ./run.sh which exports all variables found in that file. The Python script also reads ~/.longbridge/env itself. This is expected for an API-token-based tool, but it means any variables present in that file (not only the three declared tokens) will be loaded into the process. The SKILL.md does not instruct any unrelated system access, file exfiltration, or external endpoints beyond the Longbridge homepage.
Install Mechanism
No network download/install from untrusted URLs. setup.sh installs Python packages via pip (longbridge, matplotlib) which is proportionate. There is no extract-from-arbitrary-URL or remote binary install.
Credentials
Declared env vars are appropriate for the Longbridge integration. However: (1) the skill loads ~/.longbridge/env wholesale and run.sh does export $(grep -v '^#' ~/.longbridge/env | xargs), so any additional secrets placed there would be picked up; (2) monetization.md explicitly lists '匿名化用户数据卖给机构' (selling anonymized user data) as a monetization strategy — this is not implemented in code but signals a potential future data-sharing practice. Users should treat tokens as sensitive and prefer read-only or limited-scope credentials if available.
Persistence & Privilege
The skill is not always:true, does not request system-wide config changes, and does not modify other skills. It runs as a user script and relies on a user-provided env file and (optional) virtualenv; no privileged persistence is requested.
What to consider before installing
This skill is functionally coherent: it uses the Longbridge SDK to read holdings and generate charts and only needs three Longbridge credentials. Still, proceed cautiously: 1) Inspect ~/.longbridge/env before using—only store the three Longbridge tokens there and avoid adding other secrets. 2) Prefer tokens with read-only or minimal permissions if Longbridge supports scopes. 3) The monetization documentation explicitly mentions selling anonymized user data—that is not present in the code today but suggests the author may plan to collect/monetize usage data; only install if you trust the author or after confirming how user data will be handled. 4) Run the skill in an isolated environment/virtualenv and review run.sh/setup.sh to ensure they match your environment (run.sh assumes ~/.venv/longbridge). 5) If you need stronger assurance, ask the publisher for a canonical source repo (the manifest's repository URL is a placeholder) and a privacy/data-use statement, or inspect runtime network traffic to confirm no unexpected external endpoints are contacted.Like a lobster shell, security has layers — review code before you run it.
Longbridge Investment stockvk9703fbperrgvw9m0v59rwxgqx83sks6latestvk9703fbperrgvw9m0v59rwxgqx83sks6
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🦞 Clawdis
Binspython3
EnvLONGBRIDGE_APP_KEY, LONGBRIDGE_APP_SECRET, LONGBRIDGE_ACCESS_TOKEN