eastmoney skills
v1.0.4本 Skill 支持基于股票选股条件（行情指标、财务指标等）筛选满足条件的股票；可查询指定行业/板块内的股票、上市公司，以及板块指数的成分股；同时支持股票、上市公司、板块/指数推荐等相关任务，避免大模型在选股时使用过时信息。
⭐ 12· 2.8k·36 current·37 all-time
byeastmoney_dev@qqk000
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name/description match its implementation: it calls mkapi2.dfcfs.com to perform stock selection and returns/parses results. However, the registry metadata (shown above) lists no required environment variables while both SKILL.md and the code require MX_APIKEY — an inconsistency that could cause confusion at install/runtime.
Instruction Scope
SKILL.md instructs sending the user's natural-language keyword to the EastMoney/MX API and storing results locally. The code follows that exactly: it posts {'keyword': query} with apikey header, parses returned JSON/markdown tables, and writes CSV/description/raw JSON files. It does not read unrelated system files or other credentials.
Install Mechanism
There is no install spec (instruction-only plus a Python file). The code depends on the 'requests' package but no dependency declaration is provided. No remote installers or arbitrary downloads are used, so install risk is low — but runtime may fail if required Python packages are missing.
Credentials
The only secret the skill needs is an API key (MX_APIKEY), which is appropriate for a service that requires authentication. The mismatch between the registry metadata (no env vars) and SKILL.md/code (requires MX_APIKEY) is the main proportionality issue — the skill does not request unrelated secrets.
Persistence & Privilege
The skill writes output files (CSV, description, raw JSON) under /root/.openclaw/workspace/mx_data/output/ (it will create this directory). It does not modify other skills or global agent config. Persisted files may contain the user's query and the API response, so consider storage sensitivity.
Assessment
This skill appears to do what it claims (call the EastMoney/MX API and return parsed results). Before installing: 1) Note the SKILL.md and code require an MX_APIKEY environment variable even though the registry metadata omitted it — set MX_APIKEY securely in the runtime environment. 2) Confirm the API endpoint (mkapi2.dfcfs.com) and the API Key source are legitimate for your use. 3) Ensure the Python runtime has the 'requests' package available (the skill has no install spec). 4) Be aware the skill writes CSV and raw JSON files to /root/.openclaw/workspace/mx_data/output/ (these files may include your query and returned data); run in an isolated or trusted environment if that data is sensitive. 5) If you require stricter auditing, ask the publisher for a homepage/source and for the missing metadata to be corrected before enabling.Like a lobster shell, security has layers — review code before you run it.
latestvk970jehvr00mevgqe81j5nzd6s8341qj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.