jy-hk-stock-morning-brief

生成《港股资讯早报》——专业港股市场分析师角色，基于聚源数据 MCP 接口（通过 mcporter 调用）分析前一交易日市场动态、板块个股、公司公告、研报观点、南向资金、行业全景、外围市场等，为早盘投资者提供决策参考。触发词：港股早报、港股资讯早报、HK 早报、港股日报、恒指复盘、港股复盘。Generate HK...

Security Scan

The skill's claimed purpose (generate a HK market morning brief via mcporter/MCP) is plausible, but there are several mismatches and operational risks you should understand before installing.

Purpose & Capability

The skill legitimately needs mcporter (to call the MCP service) and node/npm to install it, which aligns with the description. However the shipped runtime is Python (two Python scripts) while required binaries do not list python/python3 — that's an inconsistency. The skill also requires a JY_API_KEY to configure mcporter (described in SKILL.md) but no credential or env var is declared in the metadata.

Instruction Scope

Runtime instructions call out to mcporter (mcporter call ...) which matches the stated purpose and the included scripts. Concerns: (1) the SKILL.md and scripts hardcode or recommend writing reports to /home/liust/openclaw/workspace/reports/ and editing ~/.openclaw/openclaw.json (agent config) — both are user-specific/absolute paths that may be incorrect or overwrite local config; (2) fetch_hk_data.py uses subprocess.run(..., shell=True) to construct and execute mcporter commands — if inputs are untrusted this can lead to shell injection; (3) the SKILL.md instructs obtaining a JY_API_KEY via email and embedding it in mcporter config URLs (token in URL) — token handling/storage is not standardized or declared; (4) SKILL.md refers to holiday logic but the included fetch script uses a simplified previous-day routine that does not respect the detailed holiday calendar in references/hk-holidays.md.

Install Mechanism

Install spec is a single npm package (mcporter). Using npm to install mcporter is expected and moderate risk; no arbitrary HTTP downloads or archive extraction are present. The package 'mcporter' should be verified for authenticity before global installation. The skill does not declare or install Python or the PDF libraries the Python scripts may need (weasyprint/markdown/markdown2pdf), so additional manual installs will be required.

Credentials

Metadata declares no required env vars, but SKILL.md requires obtaining a JY_API_KEY and adding it to mcporter config URLs to call MCP services. That credential requirement is real but not declared in the skill metadata. The skill asks you to configure mcporter with service URLs containing the token (token embedded in URL) — storing secrets in config files or URLs may be insecure. No other unrelated credentials are requested.

Persistence & Privilege

always:false (normal). The SKILL.md asks you to edit ~/.openclaw/openclaw.json and restart the gateway to add mcporter configuration; modifying the agent's own config is plausible for this skill but is a higher-impact action and should be done carefully (back up config first). The skill does not request global or cross-skill privileges in the metadata.

What to consider before installing

This skill appears to do what it claims (call a market-data MCP via mcporter and produce reports) but has several practical and security issues you should consider before installing: - Verify package authenticity: the install uses npm install -g mcporter. Confirm the mcporter package is the official tool and trust the publisher before installing globally. - Missing runtime declarations: the code is Python but the skill metadata does not list python/python3 or the Python PDF libraries (weasyprint/markdown/markdown2pdf). You will need to install Python and those packages separately. - Credential handling: the skill requires a JY_API_KEY (described in SKILL.md) but does not declare it as a required credential. The instructions embed the token in service URLs (mcporter config add ...?token=YOUR_KEY). Avoid storing secrets in plaintext files/URLs if possible; prefer using a secure secrets store and review where the token will be saved. - Config and paths: SKILL.md asks you to edit ~/.openclaw/openclaw.json and save reports to a hardcoded /home/liust/... path. Back up your OpenClaw config before making changes and update paths to locations appropriate for your environment. - Command-injection risk: the Python fetch script builds shell commands and runs them with shell=True. If you or other components supply untrusted strings to the script, there is a risk of shell injection. Run the scripts in a controlled environment and inspect/validate inputs. If you want to proceed: review the mcporter package, install Python and required libs in a virtual environment, configure mcporter securely (verify where tokens are stored), change hardcoded paths to safe locations, and run the scripts in an isolated or test environment first. If you prefer, request the publisher to: declare python as a required binary, declare the JY_API_KEY requirement in metadata, avoid embedding tokens in URLs, and avoid shell=True by passing arguments as a list to subprocess.run.

【港股资讯早报】

专业港股市场分析师角色，通过 mcporter call 调用聚源数据 MCP 服务，生成前一交易日市场分析报告。

功能范围

1. 趋势展望 — 恒指/国指/科指行情、市场综述、热点聚焦
2. 要闻点评 — 上市公司公告、重要新闻深度解读
3. 数据追踪 — 南向资金流向、港股通十大活跃成交股
4. 行业全景 — 聚焦行业核心动态、前景与机遇
5. 港股攻略 — 大行评级精选、目标价、大类资产观察
6. 环球视野 — 隔夜外围市场、经济数据前瞻

输出：Markdown + PDF（可选），所有数据标注来源与时间戳。

查询建议

• 目标日期：默认前一港股交易日（自动排除周末及假期）
• 数据范围：T-1 日收盘后至今日开盘前的公告/新闻为重点

查询示例：生成港股早报、帮我写今天的港股资讯早报、分析昨日港股市场表现

环境检查与配置

每次使用前必须检查 mcporter 安装和 MCP 服务配置！

步骤 1：检查 mcporter 安装

mcporter --version
# 如未安装：npm install -g mcporter

步骤 2：检查 MCP 服务配置

mcporter list
# 预期输出：必须包含 jy-financedata-tool 和 jy-financedata-api

如未配置，需获取 JY_API_KEY：

申请邮箱：[e-mail]
邮件标题：数据地图 KEY 申请-XX 公司 - 申请人姓名
正文：姓名、手机号、公司/单位全称、所属部门、岗位、MCP_KEY 申请用途、Skill 申请列表、是否需要 Skill 安装包

申请通过后获取工具版和接口版 KEY，然后配置：

mcporter config add jy-financedata-tool --url "https://api.gildata.com/mcp-servers/aidata-assistant-srv-tool?token=你的 JY_API_KEY"
mcporter config add jy-financedata-api --url "https://api.gildata.com/mcp-servers/aidata-assistant-srv-api?token=你的 JY_API_KEY"
mcporter list  # 验证

没有 JY_API_KEY 无法调用服务，必须先完成配置。

步骤 3：OpenClaw 配置

编辑 ~/.openclaw/openclaw.json 添加 mcporter 配置（详见 README.md），然后 openclaw gateway restart。

核心工作流程

工具调用可并发执行提速。详细 API 映射见 references/api-mapping.md。

步骤 1：确定前一港股交易日（排除周末、假期），参考 references/hk-holidays.md。

步骤 2-5：通过 mcporter call 并发获取数据（指数、板块、公告、研报、外围市场），所有工具入参均为 query。

步骤 6：生成 Markdown 报告（标注 API 来源）+ echarts 图表 + PDF，保存至 /home/liust/openclaw/workspace/reports/。

标准报告结构

详见 references/report-examples.md 完整样例和 references/api-mapping.md API 溯源标注指南。

模板要点：

• 每个数据项标注具体 API 来源（如 （来源：HKDailyIndexQuote））
• 表格数据在下方统一标注
• 暂缺数据注明"（聚源 MCP 暂未覆盖，建议通过 XX 查询）"
• 末尾添加"数据说明"章节，列出已覆盖/未覆盖的 API

快速开始

首次使用：完成「环境检查与配置」所有步骤。
日常使用：输入 生成港股早报，技能自动完成全流程。

数据获取策略：jy-financedata-api 获取结构化行情数据，jy-financedata-tool 获取公告/研报/新闻文本，所有工具入参均为 query，并发调用提速。

资源清单

~/openclaw/workspace/skills/jy-hk-stock-morning-brief/
├── SKILL.md                      # 本技能说明
├── README.md                     # 快速入门
├── references/
│   ├── hk-holidays.md            # 港股假期日历（2026 年）
│   ├── report-examples.md        # 完整报告样例
│   └── api-mapping.md            # API 映射与数据溯源指南（新增）
└── scripts/
    ├── fetch_hk_data.py          # 数据获取脚本（mcporter 调用）
    └── generate_pdf.py           # PDF 生成脚本

references/api-mapping.md：列出所有 MCP API 与报告章节的映射关系，包含 mcporter 调用示例和标注格式，生成报告时请查阅。

特殊情况处理

情况	处理方式
数据缺失	注明"数据暂缺"，不编造
无重大公告	简化"要闻点评"或注明"无重大公告"
非交易日	说明"分析最近交易日（X 月 X 日）数据"
财报季密集	优先处理财报相关公告
市场大幅波动（±3%）	重点分析驱动因素

输出要求

Markdown + PDF 双版本，保存至 /home/liust/openclaw/workspace/reports/，含 echarts 图表，简体中文专业风格。

数据溯源标注：每个数据项标注具体 API 来源（详见 references/api-mapping.md 完整映射表），暂缺数据注明"聚源 MCP 暂未覆盖"并提供替代查询建议。

限制

数据必须来自聚源数据 MCP；仅分析 T-1 日数据；必须配置有效 JY_API_KEY；报告末尾必须包含免责声明。

注意事项

严禁预测当日走势；每个数据项标注具体 API 来源（详见 references/api-mapping.md）；所有数据注明交易日期；暂缺数据标注"聚源 MCP 暂未覆盖"并提供替代查询建议；PDF 检查排版和图表渲染。