Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

freeStockLIneskill

v0.1.1

Free no-API-key A-share ecosystem data query skill for OpenClaw and Hermes. Use when users ask for A股、沪深京股票、指数、ETF/LOF、可转债、行业/概念板块、实时行情、K线、涨跌排行、涨停/跌停/炸板、资金流、...

0· 48·0 current·0 all-time
byWu Bo Yu@etherstrings·duplicate of @etherstrings/tonghuashun-ifind (0.5.1)

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for etherstrings/freestocklineskill.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "freeStockLIneskill" (etherstrings/freestocklineskill) from ClawHub.
Skill page: https://clawhub.ai/etherstrings/freestocklineskill
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: python3
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install freestocklineskill

ClawHub CLI

Package manager switcher

npx clawhub@latest install freestocklineskill
Security Scan
Capability signals
CryptoCan make purchasesRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description match the code: the runtime implements routing, source clients, and endpoints for A‑share data and calls public finance endpoints and free Python libs (AKShare, efinance, Tencent, Sina, etc.). Requiring only python3 is plausible, but the code clearly depends on additional Python packages (requests, efinance, akshare, pandas) that are not declared in the skill metadata.
Instruction Scope
SKILL.md directs the agent to forward the user's original natural‑language query to the smart-query CLI which will in turn query external public endpoints and libraries. That matches the stated purpose, but it means the user's exact query text is sent to third‑party servers (smartbox.gtimg.cn, suggest3.sinajs.cn, web.ifzq.gtimg.cn, and others) and may cause the agent to fetch announcement PDFs or other remote resources — expected for data collection but a privacy/exfiltration consideration.
!
Install Mechanism
There is no install spec despite multiple non‑standard Python dependencies used in the code (requests, efinance, akshare, pandas, efinance/efinance import in history path). The bundle includes .py runtime files (extract/execute on install is not used), but without declared dependency installation the skill may fail or behave unpredictably depending on the host environment. The absence of a requirements list or safe, auditable install steps is an operational / supply‑chain concern.
Credentials
The skill requests no environment variables, no credentials, and sets session.trust_env=False to avoid inheriting proxy settings. All network calls go to public finance endpoints or libraries invoked locally. No unrelated secrets or system config paths are requested.
Persistence & Privilege
always is false and the skill is user‑invocable; openai.yaml allows implicit invocation (normal). The skill does not request persistent system privileges and does not modify other skills or system settings.
Scan Findings in Context
[pre-scan:none] expected: Static pre-scan reported no regex findings. The runtime files do contain network calls and imports of third‑party libraries — those are expected for a data‑gathering skill and not flagged by the regex scanner.
What to consider before installing
This skill appears to implement the advertised free A‑share queries and will send the user's raw query to multiple public finance endpoints (Tencent, Sina, EastMoney wrappers, AKShare/efinance libraries). Before installing: (1) confirm your environment can safely make outbound HTTP(S) requests to those domains and that sending the raw query text externally is acceptable for your privacy policy; (2) ask the maintainer for a requirements.txt or an install spec (pip packages: requests, akshare, efinance, pandas, etc.) — currently only python3 is declared; (3) consider running the skill in a restricted/sandboxed environment or with network egress controls to limit unexpected traffic; (4) review the bundled source files (they are included) for any site URLs you want to block; and (5) if you require higher assurance, request the author add an explicit, auditable install step and dependency list and explain how PDF or binary attachments are handled.
scripts/runtime/freestocklineskill_runtime/sources.py:568
Dynamic code execution detected.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Binspython3
latestvk97601ys22v1q7xfh6bz5dtp5s85jkda
48downloads
0stars
2versions
Updated 1d ago
v0.1.1
MIT-0

freeStockLIneskill

Payment / Donation Notice

This skill is free to install on ClawHub, but it is donation-supported.

If freeStockLIneskill helps you save time, please support ongoing use and maintenance here:

这是给 OpenClaw / Hermes 用的 A 股免费公开源数据查询 skill。

它的设计目标很明确:不需要用户输入任何 apikey/API Key、Token、Cookie 或付费账号;在完全免费信源下尽量覆盖较大范围的 A 股生态数据,包括股票、指数、ETF/LOF、可转债、行业/概念板块、行情/K 线、排行、涨停/跌停/炸板、资金流、财务估值、公告、龙虎榜等。

先执行这个

只要用户是自然语言提问,Agent 不要猜接口,直接把用户原话交给 smart-query

python3 freestocklineskill/scripts/stockline_cli.py smart-query --query "贵州茅台最新价"

脚本会自动完成:

  • 判断意图:行情、K 线、大盘、榜单、涨停、资金流、板块、财务、公告、龙虎榜、可转债等。
  • 解析标的:股票名、6 位代码、600519.SHsh600519、指数、ETF、可转债、行业/概念。
  • 调用免费源:腾讯财经、新浪财经、东方财富、巨潮资讯、AKShare、efinance。
  • 输出统一 JSON:成功和失败都包含 okintentnormalizedsource_chaindatawarningsmeta

不要要求用户提供 API Key、Token、Cookie、iFinD、Wind、Choice、Tushare Pro 或任何付费账号。

常用命令

python3 freestocklineskill/scripts/stockline_cli.py endpoint-list
python3 freestocklineskill/scripts/stockline_cli.py search-entity --query "宁德时代"
python3 freestocklineskill/scripts/stockline_cli.py quote-realtime --symbol 600519
python3 freestocklineskill/scripts/stockline_cli.py quote-history --symbol 300750 --days 30 --period daily --adjust qfq
python3 freestocklineskill/scripts/stockline_cli.py market-snapshot
python3 freestocklineskill/scripts/stockline_cli.py rank --kind amount --limit 10
python3 freestocklineskill/scripts/stockline_cli.py limit-pool --kind up --limit 30
python3 freestocklineskill/scripts/stockline_cli.py money-flow --scope market --period instant --limit 20
python3 freestocklineskill/scripts/stockline_cli.py sector --kind industry --action rank
python3 freestocklineskill/scripts/stockline_cli.py fundamental --symbol 600519 --pack all
python3 freestocklineskill/scripts/stockline_cli.py announcement --symbol 600519 --keyword 年报
python3 freestocklineskill/scripts/stockline_cli.py dragon-tiger --date 2026-04-24
python3 freestocklineskill/scripts/stockline_cli.py news --symbol 300750 --kind news --limit 10
python3 freestocklineskill/scripts/stockline_cli.py news --symbol 300750 --kind research --limit 10
python3 freestocklineskill/scripts/stockline_cli.py chip --symbol 600519 --limit 100
python3 freestocklineskill/scripts/stockline_cli.py block-trade --date 2026-04-24 --limit 50
python3 freestocklineskill/scripts/stockline_cli.py margin-trading --date 2026-04-24 --limit 100
python3 freestocklineskill/scripts/stockline_cli.py bond --action rank --limit 20

Agent 规则

  1. 高频自然语言先用 smart-query
  2. 用户明确说查某类数据时,才使用显式命令。
  3. references/capability-matrix.md 判断稳定支持、best-effort、还是不要假装能做。
  4. references/natural-language-routing.md 了解关键词如何路由。
  5. references/use-cases.md 找类似用户问法。
  6. 输出给用户时必须带来源、交易日/时间戳、必要 warning。
  7. ok: false 时不要编造数据,复述 error.message 和可尝试的下一步。

能力边界

稳定支持:

  • 个股、指数、ETF、可转债实时行情
  • 日/周/月/分钟 K 线
  • 大盘指数与市场宽度
  • A 股涨跌幅、成交额、成交量、换手率、量比、振幅、市值、PE/PB 排行
  • 涨停池、跌停池、炸板池、强势股池
  • 全市场主力资金流排行
  • 行业/概念板块排行、成分股、个股所属板块
  • 基本信息、估值、公开财务摘要、公告 PDF、龙虎榜、可转债排行
  • 新闻快讯、公开研报/评级、筹码分布、大宗交易、融资融券 best-effort

Best-effort:

  • 个股资金流、行业/概念资金流
  • 筹码分布
  • 股东、分红、研报、新闻快讯、大宗交易、融资融券
  • 公开源字段会随网站变化,返回中必须保留 warnings

不要假装能做:

  • 实时交易所 Level-2 逐笔、盘口队列
  • Wind/Choice/iFinD 专属字段
  • 需要登录、Cookie、Token 或付费授权的数据
  • 投资建议、买卖点承诺、收益保证

Support

Donate

Alipay:

Alipay QR

WeChat Pay:

WeChat Pay QR

Comments

Loading comments...