Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Jin10 financial-data CLI wrapper that uses a required API token to query the Jin10 endpoint.
Before installing, be comfortable providing a Jin10 API token and having your financial-data queries sent to https://mcp.jin10.com/mcp. Store the token carefully, preferably as a scoped environment variable, and expect mostly Chinese CLI output and documentation.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
description: 金十数据 API Token，必需。获取方式见 https://mcp.jin10.com/app
required: true
configPaths:
- ~/.openclaw/.env # 可选，token 也可直接通过环境变量传入
---
# Jin10 金十数据 Skill
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
description: 金十数据 API Token，必需。获取方式见 https://mcp.jin10.com/app
required: true
configPaths:
- ~/.openclaw/.env # 可选，token 也可直接通过环境变量传入
---
# Jin10 金十数据 Skill
The skill contains executable Python components with access to environment variables and outbound network access, but the manifest does not declare any tool scope or permission boundaries. That weakens reviewability and containment: operators cannot easily tell that the skill will consume secrets and contact a remote MCP endpoint, increasing the risk of unintended data exposure or over-privileged execution.
This code embeds user-facing natural-language strings entirely in Chinese, including the module description and CLI help text, with no option to select another language. That creates a language/locale policy issue because the skill effectively forces a specific language on users without opt-in or justification that it is intentionally region-specific.
The file's natural-language descriptions and formatted output strings are entirely in Chinese, and there is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-only regional context. This can violate a language/locale policy when a skill imposes a specific language without user choice.
This code file contains natural-language docstrings and formatted output entirely in Chinese, including user-facing messages such as event descriptions and empty-state text. Under the policy rule for language/locale, forcing a specific language without user opt-in is a reportable issue unless the locale restriction is explicitly documented and justified.
This code file uses natural-language documentation exclusively in Chinese, including the top-level module description and many user-facing comments/docstrings, with no indication that language choice is configurable or intentionally limited to a region-specific audience. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation.
This file's docstrings and user-facing formatted output are written in Chinese, indicating the skill is effectively constrained to a specific language. The policy allows locale constraints only when justified or when the user is given a language choice, neither of which appears here.
The returned strings such as '还有更多资讯', '发布时间', and '链接' are hardcoded Chinese text shown to users. This forces a specific language/locale without any visible opt-in or alternate language handling in the file.
This file contains natural-language descriptions and formatted output in Chinese, such as the module docstring and user-facing quote labels. Under the locale policy rule, forcing a specific language without opt-in can be a policy concern when no language choice or justification is provided.
This markdown file contains Chinese-only symbol labels and search examples such as "美联储", "原油", and "非农" without explaining whether the skill requires or prefers Chinese input. That can amount to an implicit language constraint in the skill contract, which is a natural-language policy concern when no user language choice is offered.
No suspicious patterns detected.