Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Financial Ai Agent

查询金融行情数据(股票、黄金、原油等)。当用户提到查询行情、价格、指数、股票时使用。例如:'查询纳斯达克'、'现在金价多少'、'标普最近一周表现'、'设置我的key'、'替换key'。

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 37 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description (查询金融行情) match the code and SKILL.md. The code performs HTTP calls to an API (api.financialagent.cc) to fetch quotes/history and provides commands to set/show/save an API key. Required binary is only node, which is appropriate.
Instruction Scope
SKILL.md instructs running the included faa.cjs/faa.js scripts and explains key storage. The runtime instructions and code only read/write the user's ~/.faa-key, optionally read FAA_API_KEY, and call the documented remote API. The instructions do not ask to read unrelated system files or exfiltrate arbitrary data.
Install Mechanism
There is no remote install/download step (no install spec). The skill is instruction-only with included JS files; it does not fetch or execute code from arbitrary URLs during install, which is low risk.
Credentials
The skill optionally uses FAA_API_KEY and provides a default built-in key; it saves keys to ~/.faa-key. No unrelated environment variables or external credentials are requested. Storing the API key in plaintext in the home directory is expected for this use-case but notable for privacy.
Persistence & Privilege
always:false and no special platform privileges. The skill writes its own key file (~/.faa-key) which is in-scope for its purpose and it does not modify other skills or global agent configs.
Assessment
This skill appears to do what it says: call api.financialagent.cc to fetch market data and lets you store an API key in ~/.faa-key (or provide FAA_API_KEY or --key). Before installing, consider: 1) The skill sends your queries and API key to api.financialagent.cc — only use if you trust that host. 2) The saved key is stored in plaintext at ~/.faa-key and is readable by any process/user with access to your home directory; if the key is sensitive, use a dedicated key or environment variable and remove the default key. 3) There is a built-in default key in the code (may be limited/expired); using your own key is safer. 4) You can review the included faa.cjs/faa.js source (both are present and readable) — no obfuscated or hidden network endpoints were found. If you need higher assurance, verify the remote API operator (api.financialagent.cc) and consider running the code in a restricted environment first.
faa.cjs:34
Environment variable access combined with network send.
faa.js:34
Environment variable access combined with network send.
!
faa.cjs:36
File read combined with network send (possible exfiltration).
!
faa.js:36
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.2
Download zip
latestvk978d1addzzxwcmw1r008enhjh830tze

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

📈 Clawdis
Binsnode

SKILL.md

Financial AI Agent

查询金融行情数据(股票、指数、黄金、原油等)。

功能

  • 📊 查询实时行情(价格、涨跌幅)
  • 📈 查询历史走势(最近n天)
  • 🔑 用户可自定义 API Key

对话示例

用户说执行命令
查询纳斯达克faa.cjs 纳斯达克
查下黄金价格faa.cjs 黄金
标普最近一周表现faa.cjs 标普 --history
纳斯达克最近30天faa.cjs 纳斯达克 --history --days 30
纳斯达克5分钟走势faa.cjs 纳斯达克 --5min
最近20条5分钟数据faa.cjs 纳斯达克 --5min --limit 20

设置 API Key

方式1:直接说(推荐)

用户可以直接说:

  • "我的key是 xxx" → 自动保存为默认key
  • "替换key为 xxx" → 替换已有key

方式2:命令行

# 保存 key
faa.cjs --set-key 你的key

# 查看当前 key
faa.cjs --show-key

方式3:配置文件

key 保存在用户目录:~/.faa-key

关于 Key

  • 内置体验key5v9Zhv8RSqPg6nk3ZlCvyK0weY9FKdTk(有有效期限制)
  • 自定义key:可到网站 api.financialagent.cc 注册申请
  • 替换key后,下次查询自动使用新key

支持的行情

中文英文Symbol
纳斯达克NasdaqNDX
道琼斯Dow JonesDJIA
标普500S&P 500SPX
黄金GoldXAU
白银SilverXAG
原油OilCL
上证指数ShanghaiSH000001
深证成指ShenzhenSZ399001
创业板指ChiNextSZ399006

执行命令

~/.npm-global/lib/node_modules/openclaw/skills/financial-ai-agent/faa.cjs <标的> [选项]

技术说明

  • 脚本位置:~/.npm-global/lib/node_modules/openclaw/skills/financial-ai-agent/faa.cjs
  • API 地址:https://api.financialagent.cc
  • Key 保存位置:~/.faa-key

联系我们

有问题或建议请联系:pesome@gmail.com

Files

3 total
Select a file
Select a file to preview.

Comments

Loading comments…