三层筛网量化选股v1.0
WarnAudited by ClawScan on May 18, 2026.
Overview
The stock-selection logic is mostly purpose-aligned, but the script embeds and automatically uses a JQData phone/password while the skill declares no credential requirement.
Do not install or run this as-is unless the hardcoded JQData credential is removed and replaced with a clearly declared user-owned credential. Review the Python dependencies before installing, and only enable weekly Heartbeat runs if you intentionally want recurring stock-screening activity.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Users would unknowingly run the skill through a bundled third-party account, which can expose or misuse that account, rely on unknown permissions/quotas, and fail or create audit records outside the user’s control.
The script authenticates at startup with embedded JQData account credentials instead of a declared user-provided credential. This is sensitive account access and is not disclosed in the credential metadata.
import jqdatasdk as jq
jq.auth('1391868…', 'Yindb…')Remove the hardcoded credential, rotate the exposed password, and require a user-supplied JQData credential through a clearly declared environment variable or configuration path.
Installing unpinned packages may pull newer or unexpected package versions from the package index.
The skill depends on third-party Python packages that are not represented by an install spec or pinned versions. These dependencies are purpose-aligned for market-data access, but they add supply-chain review considerations.
pip install akshare jqdatasdk pandas numpy
Install only from trusted sources, consider pinning package versions, and review the packages before use.
If scheduled, the skill may keep making recurring data-provider calls and generating stock recommendations without a fresh manual run each time.
The artifact suggests a recurring weekly schedule. This is disclosed and purpose-aligned for periodic stock screening, but it would create ongoing autonomous runs if the user enables it.
建议配合OpenClaw Heartbeat每周运行一次
Only enable Heartbeat scheduling if you want recurring runs, and disable it when no longer needed.