Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

fetch-stock-daily

v1.0.0

Resolve a China A-share stock name or code in pure Node.js, fetch daily historical bars from Eastmoney HTTP APIs, and archive them as local JSON files. Use w...

0· 147·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for chenchunjiekk/fetch-stock-daily.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "fetch-stock-daily" (chenchunjiekk/fetch-stock-daily) from ClawHub.
Skill page: https://clawhub.ai/chenchunjiekk/fetch-stock-daily
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install fetch-stock-daily

ClawHub CLI

Package manager switcher

npx clawhub@latest install fetch-stock-daily
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description match the included Node.js script and README: resolving CN A‑share names/codes, calling Eastmoney list and historical kline APIs, and saving JSON archives. No unrelated credentials, binaries, or install steps are requested.
Instruction Scope
SKILL.md and the script stick to the stated workflow (resolve symbol -> fetch -> map rows -> write archive). The script performs network requests to eastmoney endpoints and reads/writes files under the repo (data/cache and data/raw). This file I/O and network access are expected for the task but are the primary side effects to be aware of.
Install Mechanism
Instruction-only skill with a bundled Node.js script and no install spec; nothing is downloaded or installed at runtime by the skill itself (lowest install risk).
Credentials
The skill declares no required environment variables or credentials. The code does not request or read external secrets; it only uses process.cwd() for local cache/archive paths.
Persistence & Privilege
The skill is not always-enabled and uses default autonomous invocation settings (normal). It does create persistent local files (cache and archived JSON) within the repository workspace; it does not modify other skills or system-wide config.
Assessment
This skill appears coherent and limited to fetching data from Eastmoney and writing local JSON files. Before installing, ensure you are comfortable with: (1) network calls to push2.eastmoney.com and push2his.eastmoney.com, (2) creation of files under data/cache/eastmoney and data/raw/eastmoney in your working directory (the script will cache symbol lists and archive results), and (3) running the script with a Node.js runtime that provides fetch and AbortSignal.timeout (Node 18+). No credentials are requested. If you prefer, run the script in an isolated/project workspace first to inspect the created files.
!
scripts/fetch_daily_json.js:183
File read combined with network send (possible exfiltration).
About static analysis
These patterns were detected by automated regex scanning. They may be normal for skills that integrate with external APIs. Check the VirusTotal and OpenClaw results above for context-aware analysis.

Like a lobster shell, security has layers — review code before you run it.

latestvk973an2v928m4zdxsvvs85e7es83tpbp
147downloads
0stars
1versions
Updated 2w ago
v1.0.0
MIT-0

Fetch Stock Daily JSON

Use this skill for the publishable Node.js path stock input -> symbol resolution -> daily history fetch -> raw JSON archive.

Quick Start

Run the Node.js helper from the repo root:

node skills/fetch-stock-daily-json/scripts/fetch_daily_json.js 贵州茅台
node skills/fetch-stock-daily-json/scripts/fetch_daily_json.js 600519 --years 3
node skills/fetch-stock-daily-json/scripts/fetch_daily_json.js 宁德时代 --start-date 20240101 --end-date 20260329 --adjust qfq

The script prints a JSON summary with the resolved symbol, row count, requested window, actual trade-date bounds, and saved file path.

Workflow

  1. Accept repo-compatible inputs only: 6-digit code, 600519.SH or 300750.SZ, or a Chinese stock name. Do not use sh600519.
  2. Prefer the bundled Node.js script instead of re-implementing the workflow in the task.
  3. Resolve stock names through the Eastmoney A-share list API and cache the code-name map locally.
  4. Fetch daily bars from the Eastmoney historical kline API with daily period and qfq/hfq/none adjustment.
  5. Save the archived rows under data/raw/eastmoney/daily_history/YYYYMMDD/<symbol>_<HHMMSS>.json.
  6. Default to years=5 and adjust=qfq when the user does not provide a date window.
  7. Stop after JSON archive generation unless the user explicitly asks for downstream parsing, analysis, or DB sync.

Return Format

Return the script's JSON summary and call out:

  • resolved_symbol
  • rows
  • trade_date_min
  • trade_date_max
  • output_path

Failure Handling

  • If name resolution fails, ask for a valid 6-digit A-share code or Chinese stock name.
  • If the fetch returns zero rows, keep the archive file and report rows: 0.
  • If you need the JS-side API details or the parity notes versus the Python workflow, read references/lobsterclaw-workflow.md.

Comments

Loading comments...