jy-wealth-investment-analysis

专业的银行理财产品分析报告生成工具。使用 mcporter 调用恒生聚源服务获取理财产品数据，按照标准化模板撰写包含产品概览、业绩表现、风险特征、资产配置、市场舆情、投资建议的完整分析报告。当用户需要分析银行理财产品、生成理财报告、评估产品投资价值、查询理财产品业绩、对比多个理财产品时触发。Professiona...

Security Scan

The skill mostly matches its stated purpose (calling an MCP service via mcporter to generate reports) but contains several mismatches and risky instructions (hardcoded file paths, undocumented Python dependencies, and guidance to embed API tokens in URLs) that don't align with the declared requirements.

Purpose & Capability

The skill's name/description (bank wealth product analysis using mcporter + 恒生聚源 data) aligns with the runtime instructions to call mcporter endpoints. However, included files (Python PDF conversion scripts) and sample reports introduce capabilities (local Markdown→PDF conversion) that the declared requirements do not cover: the install spec only installs an npm 'mcporter' package and the declared required binaries are node/npm/mcporter, but the code includes Python scripts that require Python and Python packages (weasyprint, markdown) which are not declared.

Instruction Scope

SKILL.md instructs the agent to check and configure mcporter and to add MCP service URLs embedding the token in the URL query parameter (mcporter config add ...?token=你的 JY_API_KEY). Embedding tokens in URLs is insecure (can be leaked via command history, logs). The skill also instructs editing OpenClaw agent config to enable mcporter and setting MCPORTER_CONFIG — this touches agent configuration (normal for enabling a required tool) but should be done consciously. The skill references creating cron jobs for periodic updates but gives no safe instructions for doing so. Several report files also contain references to different service names (gildata_datamap-api vs jy-financedata-api), a minor inconsistency.

Install Mechanism

Install spec: single node install of package 'mcporter' via npm. That is an expected way to install an mcporter CLI; however the package's provenance isn't shown here (npm package name only). The skill ships Python scripts and expects Python packages (weasyprint, markdown) but provides no install spec for them. The mismatch (node-only install vs included Python code) is an install/operational incoherence to be aware of.

Credentials

The skill declares no required env vars or primary credential, but runtime instructions require a JY_API_KEY (obtained separately) and show adding it directly into mcporter URLs. The skill also instructs adding MCPORTER_CONFIG into OpenClaw config. Asking users to embed an API token in service URLs (query param) is disproportionate and risky compared to common patterns (env var or config file with restricted permissions). No other unrelated credentials are requested.

Persistence & Privilege

The skill does not request 'always: true' and uses normal autonomous invocation defaults. It asks users to enable mcporter in OpenClaw config which modifies agent config to add a tool — that is typical for requiring a local CLI. There is nothing that forces permanent elevated privileges across the platform.

What to consider before installing

This skill largely does what it says (calls mcporter to fetch gildata/Hengsheng聚源 data and formats a report), but several red flags deserve attention before installing: - Missing Python dependency declarations: the repo includes Python scripts (convert_to_pdf*.py) that use weasyprint and markdown, yet the install spec only installs an npm package. If you plan to use PDF conversion, you need Python and the appropriate Python packages; otherwise these scripts could fail or be ignored. Ask the author to declare these dependencies or remove the unused scripts. - Hardcoded absolute file paths: the Python scripts read/write absolute paths under /home/yesf37332/Desktop/..., which may leak a developer username and will likely fail or read unexpected files on your host. Request that paths be relative or configurable and that scripts avoid referencing other users' home directories. - API key handling: the setup instructions show adding the API key as a URL query parameter (...?token=你的 JY_API_KEY). Embedding credentials in URLs is insecure (can be recorded in shell/history/webserver logs). Prefer storing the key in a protected config file or environment variable and avoid passing secrets on the command line. - Verify the 'mcporter' npm package: the install step uses npm install -g mcporter. Confirm the package is the official CLI you expect (publisher, homepage, checksum) before globally installing it. - OpenClaw config edits: the guide asks you to edit ~/.openclaw/openclaw.json to enable mcporter. Only make these changes if you trust the mcporter tool; enabling global tools can widen the agent's capability surface. - Minor inconsistencies in service names: some files reference different MCP service names (gildata_datamap-api vs jy-financedata-api). Ask the maintainer to clean up and document exactly which services are called. Recommended actions before installing/using: 1. Ask the author to (a) declare required runtimes (Python + packages) or remove the Python examples, (b) remove hardcoded absolute paths or make them configurable, and (c) declare the expected env vars and where credentials should be stored. 2. Confirm the npm 'mcporter' package provenance (npm registry page, maintainer) and consider installing it in a controlled environment (container) first. 3. Never paste API keys into shell commands that may be stored in history; instead configure mcporter using a config file with restricted permissions or environment variables, and prefer token storage mechanisms that avoid exposing secrets in URLs. 4. If you need PDF generation, run the conversion in an isolated environment after auditing the included scripts and installing Python dependencies. Because of these mismatches and operational risks, treat the skill as suspicious until the above issues are resolved.

银行理财分析

专业的银行理财产品分析报告生成技能，基于恒生聚源数据，生成包含产品概览、业绩表现、风险特征、资产配置、市场舆情、投资建议的完整分析报告。

功能范围

本技能支持以下功能：

1. 单产品深度分析 - 生成完整的六章节分析报告
2. 多产品对比 - 2-5 个产品的横向对比分析
3. 快速模式 - 仅生成核心数据和投资建议（500-800 字）
4. PDF 导出 - 可选生成 PDF 版本报告
5. 定期跟踪 - 设置 cron 任务定期更新产品分析

查询建议

必需要素：

• 产品代码（必填）- 理财产品唯一标识代码
• 可选：报告输出格式（Markdown/PDF）、是否快速模式

查询写法：

• "分析理财产品 [产品代码]"
• "生成 [产品代码] 的投资分析报告"
• "对比 [代码 1] 和 [代码 2] 两个理财产品"
• "快速查看 [产品代码] 的核心数据"

查询示例

分析理财产品 PR202401001
生成招银理财招智进取固收增强一号的投资报告
对比 PR202401001 和 PR202401002 两个产品
快速查看 ABC2024001 的核心数据

环境检查与配置

每次使用本技能前，必须先检查 mcporter 安装和 MCP 服务配置状态！

详细配置流程请参考：references/setup-guide.md

快速检查

# 1. 检查 mcporter 是否安装
mcporter --version

# 2. 检查 MCP 服务配置
mcporter list
# 预期输出应包含：jy-financedata-tool、jy-financedata-api

如未配置

1. 获取 JY_API_KEY：向 [e-mail] 发送邮件申请
2. 配置服务：

   mcporter config add jy-financedata-tool --url "https://api.gildata.com/mcp-servers/aidata-assistant-srv-tool?token=你的 JY_API_KEY"
   mcporter config add jy-financedata-api --url "https://api.gildata.com/mcp-servers/aidata-assistant-srv-api?token=你的 JY_API_KEY"
   

3. 验证：mcporter list

使用方式

# 所有服务工具的入参均为 query
mcporter call jy-financedata-tool.ProductBasicInfoList query="产品代码"

核心工作流程

流程中的工具调用能够并发调用尽量并发调用提速。

步骤 1：环境检查

检查 mcporter 是否安装、MCP 服务是否配置、JY_API_KEY 是否有效。

步骤 2：数据获取（并行调用）

组 1（核心数据，必须全部成功）：

• ProductBasicInfoList - 产品基本信息
• ProductPerformance - 产品业绩表现
• ProductReturnRiskIndicator - 产品收益风险指标

组 2（扩展数据，允许部分失败）：

• ProductPositionFeature - 产品持仓特征
• WealthProdFilterStats - 产品筛选统计

组 3（宏观数据，允许部分失败）：

• MacroNewslist - 宏观新闻列表
• MacroIndustryEDB - 宏观经济数据

步骤 3：数据校验

对核心数据进行合理性校验：

• 收益率范围：年化收益应在 -10% ~ 50%
• 回撤检查：应为负值，绝对值不超过 50%
• 规模检查：应大于 0

步骤 4：报告撰写

按照六章节框架撰写报告（详见 references/report-template.md）：

1. 观点摘要（≤300 字）
2. 产品概览与基本信息
3. 业绩表现深度分析
4. 风险特征与收益风险评估
5. 投资策略与资产配置解析
6. 综合评价与投资建议（含量化评分）

步骤 5：输出与导出

• 默认输出 Markdown 格式
• 可选生成 PDF 版本
• 保存到用户指定目录或桌面

快速开始

基础调用

# 调用理财产品分析工具
mcporter call jy-financedata-tool.ProductBasicInfoList query="PR202401001"
mcporter call jy-financedata-tool.ProductPerformance query="PR202401001"
mcporter call jy-financedata-tool.ProductReturnRiskIndicator query="PR202401001"

完整分析流程

# 1. 并行获取核心数据
mcporter call jy-financedata-tool.ProductBasicInfoList query="PR202401001" &
mcporter call jy-financedata-tool.ProductPerformance query="PR202401001" &
mcporter call jy-financedata-tool.ProductReturnRiskIndicator query="PR202401001" &
wait

# 2. 并行获取扩展数据
mcporter call jy-financedata-tool.ProductPositionFeature query="PR202401001" &
mcporter call jy-financedata-tool.WealthProdFilterStats query="PR202401001" &
wait

# 3. 生成报告

数据获取策略

• 优先并发：组内 API 调用尽可能并发执行
• 降级处理：非核心数据缺失时使用推断或跳过
• 缓存机制：同一产品 24 小时内可复用缓存数据

完整 API 参考：references/api-reference.md

资源清单

~/Desktop/jy-wealth-investment-analysis/
├── SKILL.md                    # 技能主文件
├── references/                 # 参考资料目录
│   ├── setup-guide.md          # 环境配置详细指南
│   ├── report-template.md      # 完整报告模板与示例
│   └── api-reference.md        # API 参数说明和数据字段定义
└── cache/                      # 数据缓存目录（运行时创建）

限制

1. 数据源限制：仅支持恒生聚源覆盖的理财产品
2. 数据时效：理财数据通常有 1 天延迟
3. 输出格式：默认 Markdown，PDF 导出需要 pdf 技能支持
4. 并发限制：服务可能有请求频率限制，建议批量调用时间隔 1-2 秒

合规声明

重要：

• 本报告仅供参考，不构成投资建议
• 投资前请阅读产品说明书，确认风险承受能力与产品风险等级匹配
• 过往业绩不代表未来表现，投资需谨慎
• 禁止使用非恒生聚源数据供应商名称（如天天基金、wind 等）

数据源标注规范

报告中的数据来源标注：

• ✅ 正确：数据来源：恒生聚源
• ❌ 避免：数据来源：恒生聚源 MCP 服务、恒生聚源 API、恒生聚源 datamap 等明细描述

原因：保持报告简洁专业，避免暴露技术实现细节。

故障排查

问题	解决方案
mcporter 命令未找到	npm install -g mcporter
MCP 服务未配置	参考 references/setup-guide.md
JY_API_KEY 无效	检查 KEY 是否正确，联系恒生聚源
产品代码不存在	确认代码格式，尝试产品全称查询