港股美股监控
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: stock-monitor-hkus Version: 1.1.0 The skill provides stock and cryptocurrency monitoring using the yfinance library. However, `scripts/monitor.py` contains a hardcoded absolute file path (`/Users/apple/.openclaw/workspace/memory/stocks_monitor.json`) for saving state, which is a significant implementation flaw and a potential security risk if the environment matches the hardcoded path. While there is no evidence of intentional data exfiltration or backdoors, the use of specific absolute paths instead of relative workspace paths is considered a high-risk vulnerability.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Installing this way could modify the user's Python environment more broadly than necessary.
The skill asks the user to install third-party Python packages without version pins and with a flag that can bypass system Python package protections.
pip3 install yfinance numpy --break-system-packages
Install the dependencies in a virtual environment and consider pinning package versions before regular use.
If enabled, the monitor will continue running on a schedule and writing logs until the user removes the cron job.
The documentation includes a cron example that would keep running the monitor every five minutes if the user installs it.
*/5 * * * * cd /path/to && python3 scripts/monitor.py >> monitor.log 2>&1
Only add the cron entry if recurring monitoring is desired, and document how to disable it.
The saved file may reveal the monitored ticker list, especially if the user customizes it, but it does not contain credentials or private account data.
The script persists monitor state into the OpenClaw workspace memory area; the stored data appears limited to update time, ticker prices, percent changes, and RSI values.
with open('/Users/apple/.openclaw/workspace/memory/stocks_monitor.json', 'w') as f:
json.dump(state, f, indent=2)Keep the state file if persistent monitoring history is useful; otherwise change or remove the write path.