Security audit
Security checks across malware telemetry and agentic risk
The skill is a stock-analysis and notification tool, but it includes root-level scheduled execution and defaults that can send stock/watchlist data to a hard-coded WeChat recipient.
Install only if you are prepared to audit and edit it first. Replace every USER_ID and holdings/watchlist value, verify the remote package source or avoid the downloader, and review/remove the root cron and logrotate files if you do not want persistent automatic WeChat stock notifications. Treat the trading recommendations as informational, not personalized financial advice.
LOGROTATE_CONF = "/etc/logrotate.d/stock-monitor"
def run(cmd):
r = os.system(cmd)
if r != 0:
print(f"❌ 命令失败: {cmd}")
sys.exit(r)# 6. 验证脚本语法
for script in ["stock_pre.py", "stock_after.py", "stock_next.py"]:
path = f"/root/.openclaw/workspace/skills/stock-push/scripts/{script}"
r = os.system(f"python3 -m py_compile {path}")
if r != 0:
print(f" ❌ {script} 语法检查失败")
else:"""发送消息，带重试机制"""
for attempt in range(1, retries + 1):
try:
result = subprocess.run(
["openclaw", "message", "send",
"--channel", "openclaw-weixin",
"--target", USER_ID,64/64 vendors flagged this skill as clean.
No suspicious patterns detected.