eastmoney skills
v1.0.5本skill基于东方财富妙想搜索能力，基于金融场景进行信源智能筛选，用于获取涉及时效性信息或特定事件信息的任务，包括新闻、公告、研报、政策、交易规则、具体事件、各种影响分析、以及需要检索外部数据的非常识信息等。避免AI在搜索金融场景信息时，参考到非权威、及过时的信息。
⭐ 17· 4.4k·19 current·22 all-time
byeastmoney_dev@qqk000
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill's code and SKILL.md consistently call the East Money endpoint (mkapi2.dfcfs.com) and require an MX_APIKEY — this aligns with the stated purpose. However, the registry metadata shown above listed no required env vars while SKILL.md and the code require MX_APIKEY; that's an inconsistency in the declared requirements.
Instruction Scope
Runtime instructions and code limit external communication to the East Money API (POST to mkapi2.dfcfs.com) and use the MX_APIKEY env var. The skill saves extracted plain text and raw JSON to a fixed workspace directory (/root/.openclaw/workspace/mx_data/output/) using filenames derived from the query (safe_filename sanitizes characters). No other system files, unrelated env vars, or external endpoints are referenced.
Install Mechanism
There is no install spec (instruction-only style) which reduces risk. A Python file is included that imports the requests library; dependencies are not declared in the manifest, so runtime may fail if requests isn't available. No remote downloads or third-party installers are used.
Credentials
The only credential required by the SKILL.md and code is MX_APIKEY, which is appropriate for calling the described API. Be aware of the mismatch between the top-level registry metadata (which listed no required env vars) and SKILL.md (which requires MX_APIKEY).
Persistence & Privilege
The skill does not request always:true and does not modify other skills or global agent settings. It writes output files to its own workspace path, which is normal but means query content and raw API responses are persisted on disk.
Assessment
This skill appears to do what it says: it sends your query to East Money's API (mkapi2.dfcfs.com) using an MX_APIKEY and returns/saves results. Before installing: 1) Confirm you trust the East Money endpoint and obtain an API key from an official source. 2) Keep MX_APIKEY secret and only set it in trusted/server-side environments (SKILL.md expects an env var). 3) Note that queries and raw JSON responses are saved under /root/.openclaw/workspace/mx_data/output/ (filenames include sanitized query text) — avoid sending sensitive data in queries or ensure the output directory is secure. 4) The package lists no install steps and the Python file imports requests; ensure the runtime has the requests library. 5) Be aware of the registry metadata mismatch (manifest claims no env vars while SKILL.md/code require MX_APIKEY); you may want the publisher to correct the metadata before wide deployment.Like a lobster shell, security has layers — review code before you run it.
latestvk97be4s7ct424p8eftbajcd339834zae
License
MIT-0
Free to use, modify, and redistribute. No attribution required.