Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small stock-quote command-line helper whose network access and optional install step fit its stated purpose, with minor disclosure issues to review.
Before installing, prefer running the script directly unless you specifically want a global a-stock command. If you create the symlink, review that /usr/local/bin/a-stock is the intended target. Treat entered ticker symbols as being sent to Tencent Finance over the network, and note the provider mismatch in the docs.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# 创建符号链接（需要 sudo 密码）
sudo ln -sf ~/.openclaw/workspace/skills/a-stock-market/a-stock.py /usr/local/bin/a-stock
# 或者直接在技能目录运行
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# 创建符号链接（需要 sudo 密码）
sudo ln -sf ~/.openclaw/workspace/skills/a-stock-market/a-stock.py /usr/local/bin/a-stock
# 或者直接在技能目录运行
All user-facing instructions and examples are presented in Chinese, which can constitute a language-policy issue when no opt-in, alternative language, or justification is provided. The file does not indicate that the skill is intentionally limited to Chinese-speaking users or a China-specific deployment context.
The skill explicitly states it uses Sina Finance's free API but does not warn users that their stock queries are transmitted to an external third party. This is a real transparency/privacy issue because users may assume queries are handled locally, and ticker interests or research activity could be exposed to the API provider or network observers.
No suspicious patterns detected.