A 股大师 Pro
Security checks across malware telemetry and agentic risk
Overview
The stock-monitoring purpose is coherent, but the package includes a real-looking QVeris API key and misleading claims that no API key is bundled.
Wait for a fixed release or manually remove the bundled QVeris key before use. Configure your own QVeris API key, inspect the downloaded dependency source, review any cron jobs, and protect the local holdings files and dashboard from other users on your network or machine.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Users could unknowingly run requests under someone else's QVeris account, expose usage patterns, or rely on a credential that can be revoked or abused.
A public skill package should not include a concrete provider API key or instruct users to persist that shared key in their shell configuration.
export QVERIS_API_KEY="sk-Gc4yIt...K8RxOZI" ... echo 'export QVERIS_API_KEY="sk-Gc4yIt...K8RxOZI"' >> ~/.bashrc
Do not use the bundled key. The publisher should remove and revoke it, replace it with a placeholder, and require each user to configure their own QVeris credential.
Users may trust the package's credential-safety claims and overlook the exposed API key.
The documentation reassures users that no API key is bundled, but INSTALL_SUMMARY.md contains a literal QVeris API key, making the safety claim inaccurate.
✅ 无硬编码 API Key ... 压缩包中不包含任何 API Key
Correct the release and upload documentation, rerun secret scanning, and publish a fixed package without embedded secrets.
The skill depends on the integrity of the remote QVeris download source.
The setup path downloads executable dependency files directly from a remote site without showing a pinned version, checksum, or signature.
curl -fSL https://qveris.ai/skill/scripts/qveris_tool.mjs -o ~/.openclaw/skills/qveris-official/scripts/qveris_tool.mjs
Prefer a verified registry install, or provide pinned versions and checksums for downloaded files.
If command strings include unvalidated local configuration values, a malformed stock code or config entry could create command-injection risk.
Multiple scripts execute a shell command variable. This appears related to the QVeris data workflow, but dynamic shell execution requires careful input handling.
const output = execSync(cmd, { encoding: 'utf8', timeout: 30000 });Use execFile/spawn with argument arrays where possible, validate stock-code formats, and avoid passing user-controlled strings through a shell.
Scheduled jobs can keep reading holdings and consuming API quota until removed.
The skill documents recurring background checks during trading hours, which is expected for monitoring but persists beyond a single conversation.
*/10 9-15 * * 1-5 export QVERIS_API_KEY="sk-xxx" && node ~/.openclaw/workspace/skills/stock-master-pro/scripts/check_holdings.mjs
Enable cron jobs only if desired, review installed schedules, and remove them when you stop using the skill.
Local files may reveal private investment positions if the machine, workspace, or dashboard files are accessed by others.
The skill persists portfolio holdings, costs, shares, dates, alerts, and watchlists in local JSON files for reuse by scripts and the dashboard.
"cost": 7.2572, "shares": 700, "buy_date": "2026-03-20" ... 系统：保存到 holdings.json
Keep the skill directory private, avoid unnecessary sensitive notes in holdings.json, and delete portfolio data when uninstalling.