Stock Watcher
PassAudited by ClawScan on May 1, 2026.
Overview
This skill looks coherent and benign, but it saves your stock watchlist locally and contacts 10jqka.com.cn to fetch stock data.
Before installing, be comfortable with a plaintext watchlist under ~/.clawdbot/stock_watcher and with 10jqka.com.cn receiving queried stock codes. Run clear or uninstall only when you want to delete the watchlist, and install Python dependencies from a trusted environment.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If the clear operation is run, the saved stock watchlist will be emptied.
The skill includes a script that intentionally clears the local watchlist file. This matches the documented clear-watchlist feature, but it is still a data-deleting action.
with open(WATCHLIST_FILE, 'w', encoding='utf-8') as f:
passOnly run clear or uninstall actions when you intentionally want to remove saved watchlist data.
Dependency installation may pull whatever current versions are available from the configured Python package index.
The documented troubleshooting step installs unpinned Python packages. This is common and user-directed, but package versions and sources are not constrained by the artifact.
pip3 install requests beautifulsoup4
Install dependencies from a trusted package source, preferably in a virtual environment, and pin versions if you need reproducible behavior.
Anyone or anything with access to that local file could see the stocks you track.
The skill persists the user's selected stock list in a local plaintext file for reuse across sessions. This is expected for a watchlist skill, but it creates durable local state.
WATCHLIST_DIR = os.path.expanduser("~/.clawdbot/stock_watcher")
WATCHLIST_FILE = os.path.join(WATCHLIST_DIR, "watchlist.txt")Do not store sensitive notes in the watchlist, and clear or uninstall the skill if you no longer want the stock list retained.
10jqka.com.cn and network intermediaries may observe which stock codes are being queried from your environment.
The skill sends each watched stock code to the disclosed external data source to retrieve performance information. This is purpose-aligned, but it shares watchlist entries with that provider.
url = f"https://stockpage.10jqka.com.cn/{stock_code}/"
response = requests.get(url, headers=headers, timeout=10)Use the skill only if you are comfortable with the disclosed stock-data provider seeing the queried stock codes.