Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

my_stock_decide_skill

v1.0.1

当且仅当用户提供持仓列表(图片或文字),并明确要求“交易决策”时触发。根据宏观形势分数动态调控T1/T2/T3的仓位比例(总上限90%),为当前持仓及观察仓标的输出明确操作方向、情绪、价格和详尽操作原因。

0· 141·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for canonxu/my-stock-decide-skill.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "my_stock_decide_skill" (canonxu/my-stock-decide-skill) from ClawHub.
Skill page: https://clawhub.ai/canonxu/my-stock-decide-skill
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install my-stock-decide-skill

ClawHub CLI

Package manager switcher

npx clawhub@latest install my-stock-decide-skill
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
Name/description describe a trading decision assistant and the SKILL.md indeed specifies producing buy/sell recommendations with target prices and position sizing — coherent. However, the runtime instructions require calling other skills (my_stock_watchlist_skill, my_stock_report_skill, us-stock-analysis) and performing realtime web/news searches, yet the skill metadata declares no dependencies, required binaries, or environment variables. The missing declaration of dependent skills and data sources is disproportionate to the metadata and may cause unexpected behavior or hidden external calls.
!
Instruction Scope
Instructions mandate realtime internet queries for eight macro dimensions, scanning for '突发重大事件' (breaking geopolitical events), and extracting sensitive portfolio information from images/text. They also require chaining to other skills for watchlists/reports. This is within the stated purpose but broad in scope: it instructs the agent to collect extensive external data and user-sensitive financial details and gives no limits on which news/APIs to use or how often to query, increasing privacy and operational risk.
Install Mechanism
Instruction-only skill with no install spec or code files. No on-disk installation risk is present.
Credentials
No environment variables, credentials, or config paths are requested (proportionate superficially). However, the skill expects to read user-provided portfolio images/text and to perform realtime web/news lookups and inter-skill calls — these are sensitive actions (financial data, news aggregation) that are not reflected in declared permissions or dependency metadata.
Persistence & Privilege
always is false and there is no request for persistent installation or modification of other skills or system configs. Autonomous invocation is allowed by default but not by itself unusual; combined with other concerns this means the skill could autonomously perform broad data queries when invoked.
What to consider before installing
Before installing, consider these points: - The skill will perform realtime web/news searches and parse user-supplied portfolio images/text; verify you are comfortable with the agent accessing that data and that your privacy policy allows it. - The SKILL.md expects to call other skills (my_stock_watchlist_skill, my_stock_report_skill, us-stock-analysis) but the package metadata does not declare those dependencies. Confirm those skills exist, are trusted, and that you understand their permissions. - The skill does not declare which news/APIs to use or whether any API keys/broker credentials will be needed; ask the author which data sources and credentials (if any) will be required before running it. - Because it outputs explicit trade orders (prices, order types), do not execute any trades automatically — review suggestions manually and ensure compliance with legal/regulatory and personal risk constraints. - If you need higher assurance, request the author to: declare dependencies and required creds, list the permitted news/data sources, and provide an explicit privacy/usage statement for user financial data. If you cannot confirm these details, treat the skill cautiously or run it in a restricted/test environment only.

Like a lobster shell, security has layers — review code before you run it.

latestvk97cpea5dpz1ze35xwshj7w4cs83wtm0
141downloads
0stars
2versions
Updated 4w ago
v1.0.1
MIT-0

My Stock Decide Skill (美股交易决策技能)

1. 触发条件

  • 触发条件:仅在用户明确要求做“交易决策”,并且提供持仓/资金情况(通过文本或图片)的情况下触发。

2. 过程约束

  • 实时数据 必须始终基于当前系统时间,通过API/web search实时联网查询最新数据,如果因为各种原因无法查询则中断,跟用户反馈,不要臆测或者使用历史会话数据;
  • 及时互动 工作流中的每一步执行完成后,马上向用户进行同步,对于遇到任何错误,马上停止,告诉用户错误的原因;

3. 仓位管理与分类体系

做好整体仓位控制,最终总持仓不得超过总资产的 90%。资产需分为以下三层梯队:

  • T1 核心 (Core):压舱石,精选优质蓝筹。建议仓位:~30%
  • T2 趋势 (Growth):趋势增长,聚焦高增速、高Beta标的,捕捉起涨点动能。建议仓位:~20%
  • T3 卫星 (Satellite):卫星博弈,高弹性题材与事件驱动标的。建议仓位:~20%

3. 宏观形势分数

必须始终基于当前系统时间,实时联网查询以下八大核心宏观维度的最新数据,综合分析后进行打分(范围:1 到 10 分/维度)。

影响美股宏观走势的八大核心维度(按权重排序):

  1. 美联储货币政策:利率水平/点阵图、降息加息预期、资产负债表变化、10年期/2年期美债收益率曲线、美联储官员讲话信号
  2. 地缘政治与黑天鹅:中东局势(油价影响)、俄乌冲突外溢、中美关系变化、突发重大事件(必须实时检查)
  3. 通胀数据:CPI/核心CPI、PPI/核心PPI、PCE物价指数(美联储首选)、油价变动及传导
  4. 美国经济基本面:非农就业/失业率、GDP增速、消费者信心、零售销售、制造业/服务业PMI
  5. 企业盈利与资本开支:标普500整体盈利增速、科技巨头资本开支指引、企业股票回购规模
  6. 美元指数与全球流动性:美元强弱、全球美元松紧、新兴市场风险溢出
  7. 大选与政治周期:现任总统选情、候选人政策主张(关税/财政/监管)、国会控制权预期
  8. 市场结构与情绪:波动率(VIX)、散户仓位/杠杆率、机构持仓集中度、基金现金比例

⚠️ 强制规则:必须实时搜索最新新闻,检查是否存在突发地缘政治事件、重大黑天鹅。此类事件对市场影响极大,不得遗漏。

评分标准

每个维度评分范围:1 - 10 分

  • 1-3分:环境恶劣/重大风险
  • 4-6分:环境中性/一般
  • 7-10分:环境良好/有利

动态阈值与仓位调控规则:

  • 总分/8 > 7(平均 > 7,环境极好): 总持仓上限可达 90%,允许 T2/T3 比例向上浮动(例如 T2 提升至 30%)。
  • 总分/8 < 4(平均 < 4,环境恶劣): 进入防守模式,强制缩减T2仓位到5-10%, T3 仓位至 5%-10%,甚至将总持仓上限大幅降至 40%-50%。
  • 其他分数: 维持默认的稳健配置比例(T1 30%, T2 20%, T3 20%)。

4. 工作流程

必须严格按照步骤进行,且每一步必须都有及时的输出

  1. 环境解析,明确分析标的

    • 识别用户提供的持仓列表。
    • 使用多模态模型原生能力(直接通过会话媒体流读取),从图片中提取资产和持仓信息,严禁调用本地 vision 工具。
    • 联动 my_stock_watchlist_skill 获取观察仓的重点标的列表。当前持仓列表和观察仓重点标的一起,作为标的分析和操作范围;
    • 从图片或者文字中,识别总资产,当前持仓总资产,用于仓位管理。
    • 输出 分析和操作标的范围,当前的总资产和仓位情况
  2. 宏观研判,明确宏观形式分数

    • 按照八大核心维度逐一获取最新宏观数据,全面覆盖所有驱动因素,不遗漏任何关键信息。
    • 输出宏观形势分数和定性,并给出判定原因。
  3. 标的决策,明确每只标的的分析:根据用户要求,指定my_stock_report_skill 还是us-stock-analysis,默认使用us-stcok-analysis

    • 使用my_stock_report_skill对持仓和观察仓中的每个标的,遍历地进行独立评估,结合宏观环境和个股基本面/技术面给出决策(不要批量,避免限流)
    • 使用us-stock-analysis对持仓和观察仓中的每个标的,遍历地进行独立评估,给出每只标的的判断(不要批量,避免限流)
    • 输出每只标的的评估概要和判断,每分析完成一只则输出一只的结论,不要等全部完成后在输出
  4. 仓位决策,明确操作

    • 根据每只标的的分析结果,结合宏观形式分数,按照动态阈值和仓位调控规则,给出整体的操作方向(如MU 390 STRONG BY 20股),使得基本最终仓位结构符合调控目标(浮动+-10%)
    • 输出整体仓位配比(T1/T2/T3),具体到标的操作方向,哪些HOLD,哪些在什么价位卖出多少股,哪些在什么价位买进多少股。并计算如果都交易成功,最终的仓配配比(T1/T2/T3比例,分别是哪些标的多少股)。
  5. 最终操作指令

  • 输出的最终指令必须涵盖决策范围内的每个标的,且每个标的的决策信息必须包含以下6个要素:
  • 标的简码 (Ticker):如 AAPL, TSLA 等。
  • 操作方向 (Action):BUY / SELL / HOLD (对于明确且强烈的动作,使用 STRONG BUY 或 STRONG SELL)。
  • 操作情绪 (Sentiment):普通 / 强烈。
  • 订单类型 (Order Type):必须明确指示是 市价单 (Market Order/MO) 还是 限价单 (Limit Order/LO)
  • 操作价格 (Target Price):给出明确的买入/卖出/止损目标价格。
  • 操作原因 (Rationale)必须充分详尽,阐述为何在此宏观背景及个股结构下做出该方向的判定。

Comments

Loading comments...