!
Purpose & Capability
The skill’s stated purpose (A-share pre-open analysis) matches the included scripts and assets (Eastmoney/Tencent data pulls, watchlists, RSS iterator). However the registry metadata claims 'Required env vars: none' while SKILL.md and README repeatedly state the skill hard-requires an EM_API_KEY (maps to MX_APIKEY). That metadata mismatch is incoherent and could mislead users about credential needs.
ℹ
Instruction Scope
SKILL.md instructs the agent/user to run many local Python scripts that: call Eastmoney (push2.eastmoney.com), Tencent quote endpoints (qt.gtimg.cn), MX endpoints (mkapi2.dfcfs.com), and public RSS feeds; write outputs (markdown/jsonl/SQLite) under ~/.uwillberich/; and can install a long-running news iterator. Those actions are consistent with the stated purpose but they read and persist local runtime credentials (~/.uwillberich/runtime.env) and create local state files — review those scripts before running.
✓
Install Mechanism
No remote install spec is included in the registry entry (instruction-only). The repo bundles Python scripts (standard-library oriented) rather than providing an automatic remote download. Risk is lower than packages that fetch arbitrary binaries, but running bundled scripts still executes code on your machine — inspect before running.
!
Credentials
The skill legitimately needs an Eastmoney/MX API key (EM_API_KEY / MX_APIKEY) to access market and MX endpoints — that single credential is proportionate to its function. The concern is that the registry metadata omitted this requirement, and the scripts suggest writing the key to ~/.uwillberich/runtime.env and mapping it to MX_APIKEY automatically. Confirming what runtime_config.py does (read/write behavior, permissions, storage format) is advised.
ℹ
Persistence & Privilege
The skill includes scripts to run a persistent news iterator and a macOS launchd installer for scheduled polling; it writes state under ~/.uwillberich/news-iterator/ and can run background processes. It does not request 'always: true' or system-wide privilege changes in the metadata, but installing a background job is a non-trivial persistence action — the user should opt in explicitly and inspect launchd install code before use.
What to consider before installing
This skill appears to do what it claims (A-share pre-open research) and uses expected APIs (Eastmoney, Tencent, MX, public RSS), but note two red flags: 1) the registry metadata omitted the required EM_API_KEY while SKILL.md/README say it is mandatory — confirm the key requirement before installing; 2) the package can persist locally (writes ~/.uwillberich/, creates SQLite/jsonl, and can install a launchd job). Before installing or running scripts: - Inspect scripts/runtime_config.py to see how it stores/reads your API key and whether it transmits it only to the documented endpoints. - Check any code that calls mkapi2.dfcfs.com (MX endpoint) to confirm the exact requests and whether your key is used only for intended queries. - If you don't want persistent polling, do not run install_news_iterator_launchd.py or the news_iterator loop; run one-off scripts only. - Avoid running install scripts as root; restrict runtime file permissions (store runtime.env with 600). - If you have operational or regulatory concerns about sending data to third-party endpoints, test the scripts in a network-controlled environment or review network calls in detail. If you want, I can inspect specific script files (runtime_config.py, mx_toolkit.py, news_iterator.py, install_news_iterator_launchd.py) and summarize exactly what HTTP requests they make and what they store locally.
