实时财经数据

实时财经数据查询技能 - 支持A股、港股、美股、黄金、原油、VIX、美债等

Security Scan

The skill's code, instructions, and requirements are consistent with a realtime finance query tool that uses Sina and Yahoo Finance; no disproportionate credentials, installers, or unrelated behavior were found, though it makes network calls (including an unencrypted HTTP call) and the source is unknown so review before use.

Purpose & Capability

Name/description match the implementation: the script queries Sina Finance for A/H market data and Yahoo Finance (via yfinance) for US markets, commodities, indices and FX. Declared required binary (python3) and optional dependency (yfinance) are appropriate for this purpose. No unrelated credentials, binaries, or config paths are requested.

Instruction Scope

SKILL.md instructs the agent to run the included Python script from the skill workspace path — that matches the provided files. The script performs network requests to expected external services (hq.sinajs.cn for Sina and Yahoo via yfinance). Note: the Sina request uses plain HTTP (http://hq.sinajs.cn/list=...), which is unencrypted and susceptible to MITM/tampering; this is a security/privacy consideration but not incoherent with the skill's stated purpose.

Install Mechanism

There is no automated install spec; SKILL.md suggests 'pip3 install yfinance' which is a standard, minimal dependency. No downloads from arbitrary URLs or archive extraction were specified. The skill is instruction-only in the registry but includes code files — that's consistent (script is executed directly).

Credentials

The skill requires no environment variables or secret credentials. It does not request access to unrelated services. The only external dependency is the public yfinance package (pip), which requires network access to fetch but no secrets.

Persistence & Privilege

Flags show always:false and model invocation enabled (normal). The skill does not request persistent system-wide privileges or modify other skills. It runs as a script in the skill workspace and doesn't declare any elevated or persistent privileges.

Assessment

This skill appears to do what it says: fetch realtime quotes from Sina (A/H) and Yahoo (US/commodities/FX). Before installing, consider: 1) The script makes network requests to public endpoints (Sina and Yahoo); allow network only if you trust those services. 2) The Sina call uses HTTP (not HTTPS), so responses could be tampered with on a hostile network — avoid using on untrusted networks or prefer HTTPS if you modify the script. 3) yfinance is installed via pip — verify you trust the package source and consider installing in a virtualenv. 4) The skill source/homepage is unknown; if you need stronger assurance, review the full realtime_finance.py file yourself (or run it in a sandbox) to confirm there are no unexpected network endpoints or logging/exfiltration steps. If you are satisfied, the requested permissions and behavior are proportionate for a finance-quote tool.

实时财经数据技能

使用新浪财经 + Yahoo Finance 获取实时财经数据。

支持的数据

市场	数据源	示例
A股	新浪财经	茅台、宁德时代、上证指数
港股	新浪财经	腾讯、阿里、美团
美股	Yahoo Finance	AAPL、TSLA、NVDA
大宗商品	Yahoo Finance	黄金(GC=F)、原油(CL=F)
指数	Yahoo Finance	VIX、美债收益率(TNX)
外汇	Yahoo Finance	美元指数(DXY)

工具调用

当用户询问财经数据时，自动调用：

python3 ~/.openclaw/workspace/skills/realtime-finance/realtime_finance.py <查询内容>

触发条件

• "查一下茅台股价"
• "今天大盘怎么样"
• "VIX多少"
• "黄金价格"
• "美股行情"
• "美债收益率"

依赖

• Python 3
• yfinance: pip3 install yfinance

文件位置

~/.openclaw/workspace/skills/realtime-finance/