Investage Temp

價值投資每日追蹤系統 - 整合估值、技術分析、情緒分析，輸出綜合評分報告並發送 Email。適用於個人投資組合追蹤。

Security Scan

The skill is an investment tracker that generally does what it says, but the code and runtime instructions are inconsistent (hardcoded DB/recipient values and undeclared dependencies like the 'gog' CLI), which raises concerns before installation.

Purpose & Capability

The skill's stated purpose (daily portfolio tracking, analysis, and email reports) aligns with the code. However, the code contains hardcoded database credentials (host=localhost, database=investage, user=george) and hardcoded RECIPIENTS emails inside scripts rather than reading config.yaml or environment variables as the SKILL.md implies. The SKILL.md instructs exporting PGHOST/PGDATABASE/PGUSER and using config.yaml, but the main scripts ignore those environment variables and the example config, which is incoherent and could cause surprising behavior or accidental use of the developer's defaults.

Instruction Scope

SKILL.md tells the user to set env vars, create DB tables, and configure config.yaml, and to use the 'gog' CLI for email. The runtime scripts, however, directly connect to a local PostgreSQL database using hardcoded credentials and call the 'gog' CLI via subprocess without declaring it as a requirement. The scripts access external network services (yfinance, Reddit, Polymarket) — which is expected for data gathering — but these outbound requests and email-sending behavior are not clearly represented in the registry metadata or required environment list. The SKILL.md's instructions and the code's behavior diverge in ways that give the agent broad discretion (DB writes, email sending, external network calls).

Install Mechanism

There is no install spec (instruction-only), which minimizes direct install-time risk. However, the skill depends on system-level components not declared in the registry: PostgreSQL availability, Python packages (yfinance, psycopg2, requests, pandas, numpy), and the 'gog' command-line tool for sending email. Those missing/undeclared dependencies create operational surprise and elevated risk if users assume no extra tools are required.

Credentials

Registry metadata lists no required environment variables or credentials, but the code uses a hardcoded DB_CONFIG and hardcoded email recipients and a hardcoded GOG_ACCOUNT. The SKILL.md suggests using PGHOST/PGDATABASE/PGUSER and config.yaml, but the script implementations ignore those and use embedded values. This mismatch is disproportionate and potentially dangerous: secrets or private holdings could be stored/sent to the developer's defaults if left unchanged. The skill also sends reports externally via email (gog), which means data collected locally will be transmitted off-host.

Persistence & Privilege

always:false (no forced persistence). The skill can be invoked autonomously (disable-model-invocation:false), which is the platform default. This combined with the ability to send emails and write to a DB increases blast radius, but autonomous invocation alone is not unusual. The skill does not request to modify other skills or system config files.

What to consider before installing

This skill mostly matches its description (portfolio tracking + analysis + email reports) but contains inconsistencies that you should resolve before using it: - Inspect and edit the scripts: replace hardcoded DB credentials (user 'george', empty password) and RECIPIENTS with values from a config.yaml or secure environment variables. The current defaults look like developer/test values and could leak data or cause accidental writes to an unintended database. - Declare and install required dependencies: PostgreSQL, Python libs (yfinance, psycopg2, pandas, numpy, requests), and the 'gog' CLI. SKILL.md mentions gog but the skill registry did not list it as a required binary. - Understand data flows: the skill fetches external data (yfinance, Reddit, Polymarket) and will send HTML reports via the 'gog' email CLI to the configured recipients. If you run this on a machine with sensitive holdings data, ensure email recipients are correct and that network calls are acceptable. - Run initially in a sandboxed environment and with a test config (no real holdings, test email) to confirm behavior. Review and create the needed DB tables (the SKILL.md shows some SQL but the code expects additional tables like thesis_history and portfolio_snapshot). - If you lack confidence editing the code, consider not installing or ask the author to provide a version that reads credentials from config.yaml/environment and documents all external dependencies. Because of these mismatches and hardcoded defaults, treat the skill as suspicious until you fix or verify its configuration.

Investage - 價值投資每日追蹤系統

⚠️ 注意：此為公開模板版本。個人持股資料請見 config.example.yaml

功能

• 持股追蹤 - 追蹤你的投資組合每日變化
• 技術分析 - MA(30/100/200)、RSI、成交量、K線型態、乖離率
• 估值分析 - Yahoo Finance 分析師目標價
• 情緒分析 - Reddit 社區討論情緒
• 綜合評分 - 加權評分系統 (BUY/HOLD/WATCH/SELL)
• 每日報告 - HTML Email 自動發送

資料庫設定

# 建立 PostgreSQL 資料庫
createdb investage

# 連線
psql -d investage -U your_user

安裝

# 複製到你的 skills 目錄
cp -r investage ~/.openclaw/workspace/skills/

# 設定資料庫連線
export PGHOST=localhost
export PGDATABASE=investage
export PGUSER=your_user

資料表結構

-- 股票主檔
CREATE TABLE stocks (
    ticker VARCHAR(10) PRIMARY KEY,
    company_name VARCHAR(100),
    sector VARCHAR(50),
    currency VARCHAR(10) DEFAULT 'USD'
);

-- 持股記錄
CREATE TABLE holdings (
    id SERIAL PRIMARY KEY,
    ticker VARCHAR(10) REFERENCES stocks(ticker),
    shares DECIMAL(15,4),
    avg_cost DECIMAL(10,4),
    purchase_date DATE DEFAULT CURRENT_DATE
);

-- 觀察清單
CREATE TABLE watchlist (
    id SERIAL PRIMARY KEY,
    ticker VARCHAR(10) UNIQUE NOT NULL,
    added_date DATE DEFAULT CURRENT_DATE,
    reason TEXT,
    status VARCHAR(20) DEFAULT 'WATCHING'
);

使用方式

# 發送每日報告
python3 scripts/email_reporter.py

# 技術分析測試
python3 scripts/technical_analyzer.py NVDA

# 估值分析測試  
python3 scripts/valuation_analyzer.py NVDA

評分權重

維度	權重
估值	30%
趨勢	25%
宏觀/情緒	20%
技術信號	15%
風險	10%

評分等級

分數	建議
≥65	🟢 BUY (買入)
50-64	🔵 HOLD (持有)
40-49	🟡 WATCH (觀望)
<40	🔴 SELL (賣出)

Email 設定

使用 gog 發送：

# 確認 gog 已設定
gog auth list

# 發送報告
gog gmail send --to [e-mail] --subject "Daily Report" --body-html report.html

Cron Job 設定

# 每日早上 07:30 發送報告 (台灣時間)
30 7 * * 1-5 python3 /path/to/scripts/email_reporter.py

自訂欄位

在 config.yaml 設定你的：

• Email 收件者列表
• 追蹤標的
• 持股資料

技術棧

• Python 3
• yfinance (股價數據)
• psycopg2 (PostgreSQL)
• gog (Email 發送)

授權

MIT License

---

此為開源模板，個人持股資料請自行設定於 config.yaml