Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Stock Clawhub

v1.0.0

提供股票查询和分析功能,支持 A 股、港股、美股和 ETF 查询,包括实时价格查询、基本面分析、技术指标分析、高潜力股推荐等。

0· 103·1 current·1 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for shinewilzhang/stock-clawhub.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Stock Clawhub" (shinewilzhang/stock-clawhub) from ClawHub.
Skill page: https://clawhub.ai/shinewilzhang/stock-clawhub
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install stock-clawhub

ClawHub CLI

Package manager switcher

npx clawhub@latest install stock-clawhub
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md and description claim integration with providers like 东方财富、同花顺、Yahoo Finance、Bloomberg and AI-based analysis, but the shipped script only issues GET requests to a single domain (https://api.mock-stock.com) and implements only simple fetches and passthroughs; features such as notifications, watchlist management, scheduled updates, and AI analysis are described but not implemented. No API keys or credentials are requested despite some listed sources normally requiring them.
Instruction Scope
Runtime instructions (SKILL.md) describe user-facing slash-like commands and many capabilities, but do not specify exact network endpoints or required credentials; the actual script expects CLI commands (price/info/etf/recommend) and will make outbound HTTPS requests to api.mock-stock.com. The SKILL.md suggests scheduled tasks and notifications, but there is no code or install spec that implements scheduling, notification delivery, or watchlist persistence.
Install Mechanism
No install spec is provided (instruction-only plus a small script). Nothing is downloaded or written during install, which minimizes install-time risk. The presence of a script on disk is expected for an instruction-plus-helper-script skill.
!
Credentials
No environment variables or credentials are declared, yet SKILL.md references third-party APIs (some of which commonly require API keys). The script does not request or use credentials, which is inconsistent with the stated data sources and raises the question whether a single private API is aggregating data (and whether that vendor is trustworthy).
Persistence & Privilege
The skill does not request always:true and uses default autonomous invocation settings; it does not attempt to modify other skills or system configs. No elevated persistence or privileges are declared.
What to consider before installing
Do not enable this skill for production use yet. Ask the publisher to explain the discrepancy between the documentation and the code: which real data sources will be called, why the script points to api.mock-stock.com, and whether that host is controlled by a trusted vendor. Request that any required API keys be declared in requires.env (and limited in scope), or replace the mock endpoint with calls to known, documented APIs. If you test it, run it in a sandbox/network-restricted environment and inspect TLS certificates and the resolved IP/owner for api.mock-stock.com. If you expect notifications, scheduling, or AI analysis, require the developer to provide the code that implements those features and to document what external endpoints will receive user data.

Like a lobster shell, security has layers — review code before you run it.

latestvk9745x6602t5w9ackhxxvx2r5983yr66
103downloads
0stars
1versions
Updated 4w ago
v1.0.0
MIT-0

Stock Skill - 股票查询与分析技能

概述

这个技能提供股票查询和分析功能,支持 A 股、港股、美股和 ETF 查询。

功能

实时股票价格查询

  • 查询 A 股、港股、美股的实时价格
  • 支持股票代码和名称查询

股票基本面分析

  • 市值、市盈率、市净率等财务指标
  • 股息率、ROE 等投资指标

技术指标分析

  • K 线图、均线分析
  • MACD、RSI 等技术指标

ETF 数据查询

  • A 股市场可购买的 ETF 查询
  • 包括黄金、纳斯达克指数、标普消费、标普生物科技等 ETF

高潜力股推荐

  • 基于基本面和技术面分析推荐高潜力股票
  • 提供详细的分析报告和投资理由

关注股票管理

  • 允许用户添加和管理关注的股票列表
  • 定期分析关注股票的表现

使用方法

查询股票价格

/股票 贵州茅台
/股票 600519

查询 ETF 价格

/etf 纳斯达克
/etf 黄金

添加关注股票

/关注 贵州茅台
/关注 600519

查询关注股票

/关注列表

获取推荐股票

/推荐

技术实现

数据源

  • 国内股票数据:使用东方财富、同花顺等 API
  • 国际股票数据:使用 Yahoo Finance、Bloomberg 等 API
  • ETF 数据:使用中证指数、华夏基金等 API

分析方法

  • 基本面分析:基于财务报表和经济数据
  • 技术分析:基于价格走势和技术指标
  • AI 分析:使用机器学习模型预测股票走势

配置

数据更新频率

  • 实时价格:每分钟更新
  • 基本面数据:每日更新
  • 分析报告:每周更新

通知设置

  • 价格提醒:当关注股票价格波动超过一定幅度时通知
  • 定期报告:每周发送关注股票的分析报告

限制

  • 数据准确性受限于数据源的可靠性
  • 分析结果仅供参考,不构成投资建议
  • 投资有风险,入市需谨慎

更新日志

v1.0.0 (2025-01-01)

  • 初始版本
  • 支持股票价格查询
  • 支持 ETF 价格查询
  • 支持关注股票管理
  • 支持高潜力股推荐

Comments

Loading comments...