Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

A Stock

v0.1.1

A股金融数据查询与分析助手。当用户询问任何与A股相关的问题时,使用此技能——包括:查询个股信息、实时行情、分时走势、龙虎榜、行业板块、盘口异动、市场总貌等。触发词包括但不限于:股票、A股、沪市、深市、行情、涨停、跌停、板块、龙虎榜、盘口异动、个股、股价、总市值、证券,或任何带有6位股票代码的查询(如 600519...

0· 101·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for wwzzsl/stock-skill-2.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "A Stock" (wwzzsl/stock-skill-2) from ClawHub.
Skill page: https://clawhub.ai/wwzzsl/stock-skill-2
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install stock-skill-2

ClawHub CLI

Package manager switcher

npx clawhub@latest install stock-skill-2
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description, the included scripts, and the declared API host (api.aipmedia.cn) are consistent: the skill needs an ASTOCK_API_KEY and the TypeScript client calls that host. However, the top-level registry metadata (shown to you earlier) claims 'Required env vars: none' and 'Required binaries: none', while SKILL.md and scripts require ASTOCK_API_KEY and Node/npx. That metadata mismatch is an incoherence (likely sloppy packaging) that you should verify.
Instruction Scope
SKILL.md gives narrow, explicit runtime instructions: always run the included TypeScript client with npx tsx, obtain ASTOCK_API_KEY from .env or environment, and only call api.aipmedia.cn. The client code only reads ASTOCK_API_KEY (from .env in working dir or parent, or from env), performs an HTTP GET, and prints the returned data. There are no instructions to read or transmit other local files.
Install Mechanism
There is no external install/download step: the repo includes an instruction file and a single scripts/api-client.ts. No remote installers, archives, or obscure URLs are used. This is lower risk from an install-mechanism perspective.
!
Credentials
The skill legitimately requires a single API key (ASTOCK_API_KEY) for the stated API, which is proportionate. The concern is twofold: (1) the registry metadata omitted declaring the required env var and required runtime (Node/npx), making the package metadata inconsistent; (2) the script searches for .env in the current and parent directory, which could accidentally pick up an unrelated .env file containing other secrets if you run it from an unexpected location. The client sends the API key as a header to api.aipmedia.cn — you must trust that host and the key usage.
Persistence & Privilege
The skill does not request permanent presence (always:false) and the script does not persist secrets or modify other agent configuration. It reads the API key at runtime and does not write it or other data to disk.
What to consider before installing
What to check before installing/using: 1) Confirm the skill source (review the GitHub repo at the provided homepage) to ensure it matches the package you installed. 2) Verify the metadata mismatch: SKILL.md requires ASTOCK_API_KEY and Node/npx, but registry metadata omitted these — treat that as a packaging error and confirm requirements. 3) Avoid running the script from directories containing other .env files with unrelated secrets; prefer setting ASTOCK_API_KEY as an explicit environment variable or create a dedicated project directory with a minimal .env. 4) Inspect scripts/api-client.ts yourself (it is short): it only reads ASTOCK_API_KEY and calls https://api.aipmedia.cn; if you trust that service, the behavior is consistent. 5) If you have concerns about leaking the API key, isolate the process (container/VM) or review network egress controls; otherwise the key will be sent to api.aipmedia.cn as intended. 6) If you want higher assurance, ask the publisher to fix the package metadata to declare required env vars and runtime binaries. If any of these points are unclear or you want help checking the repo contents or running the script in a safe environment, I can assist.
scripts/api-client.ts:49
Environment variable access combined with network send.
!
scripts/api-client.ts:40
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk97dftbenv584fptqgm0fyh9r183ayym
101downloads
0stars
2versions
Updated 1mo ago
v0.1.1
MIT-0

A股金融数据 Skill

🚫 调用方式硬性规定

**严禁使用 curl 调用接口。唯一允许的调用方式是:

  • npx tsx ~/.gemini/skills/a-stock-skill/scripts/api-client.ts /api/stock/... — 正确

api-client.ts 会自动从 .env 文件或环境变量读取 ASTOCK_API_KEY,无需在命令行传入 apiKey。

概述

此 Skill 帮助用户查询 A 股各类金融数据,并以清晰易读的格式展示结果。

API Base URL: https://api.aipmedia.cn
认证方式: 请求 Header 中传入 apiKey,用户需前往 https://aipmedia.cn/ 个人中心查看自己的 apiKey。


⚠️ 核心约束(必须遵守)

所有 A 股数据必须通过下方 API 接口获取,严禁使用 Google Search、网页搜索或训练数据中的历史行情作为答案。

  • ✅ 正确:用 bash_tool 执行 TypeScript 脚本调用 https://api.aipmedia.cn/api/stock/...
  • ❌ 错误:调用搜索引擎查询行情、引用训练数据中的股价、给出"大约/估计"的数字

如果接口调用失败,明确告知用户失败原因,不要用搜索结果替代。

apiKey 配置规则

执行前必须检查 apiKey 是否可用,优先级如下:

  1. 项目根目录 .env 文件中的 ASTOCK_API_KEY
  2. 系统环境变量 ASTOCK_API_KEY
  3. 以上均无 → 停止调用,告知用户:

    ❌ 未找到 API Key,请前往 https://aipmedia.cn/ 登录后在「个人中心」查看 API Key,然后在项目根目录创建 .env 文件并添加:ASTOCK_API_KEY=你的apiKey


工作流程

  1. 理解用户意图 → 判断属于哪个查询模块(见下方模块说明)
  2. 收集必要参数 → 股票代码、日期、板块名称等(若缺失,向用户询问)
  3. bash_tool 执行 TypeScript 脚本 → 调用 scripts/api-client.ts(见下方调用示例)
  4. 解析并展示 → 将返回的 JSON 数据格式化为 Markdown 表格
  5. 提供解读 → 结合金融知识,给出简明的数据解读

模块一:市场总貌

上交所股票数据总貌

  • 接口: GET /api/stock/sse_summary
  • 说明: 返回最近交易日的沪市股票数据(收盘后统计)
  • 参数: 无必填(可传 lng: zhen
  • 真实返回结构: 按项目分行,列为 股票(整体)/ 主板 / 科创板
    • 项目包括:上市公司数、上市股票数、总市值、流通市值、总股本、流通股本、平均市盈率
  • 展示重点: 用三列表格(股票整体/主板/科创板)呈现各项指标,金额换算为亿元,并解读主板/科创板估值差异

深交所证券类别统计

  • 接口: GET /api/stock/szse_summary
  • 说明: 深市按日期查询
  • 必填参数: date(格式:YYYY-MM-DD,如 2024-01-15
  • 展示重点: item/value 键值对,格式化为表格

模块二:个股查询

股票代码格式示例:上交所 600519(贵州茅台),深交所 000001(平安银行)

个股基本信息(东财)

  • 接口: GET /api/stock/individual_info_em?symbol=<代码>
  • 展示重点: 公司名称、行业、上市日期、总股本、流通股本等 item/value 键值对

个股基本信息(雪球)

  • 接口: GET /api/stock/individual_basic_info_xq?symbol=<代码>
  • 展示重点: 与东财互补,包含行业分类代码(ind_code)和行业名称(ind_name)
  • ⚠️ 注意: 此接口依赖雪球数据源,若返回 500,说明雪球服务暂时不可用,改用东财接口代替

行情报价(东财)

  • 接口: GET /api/stock/bid_ask_em?symbol=<代码>
  • 展示重点: 买卖五档报价、委比、委差等

个股实时行情

调用优先级:先调主接口,主接口成功则不再调备用接口。

  • 主接口(东财,稳定): GET /api/stock/individual_info_em?symbol=<代码>

    • 已验证可用,返回最新价、涨跌幅、成交量、成交额、换手率、市盈率、总市值等完整行情
    • 数据格式:[{item, value}] 键值对数组
  • 备用接口(雪球,不稳定): GET /api/stock/individual_spot?symbol=<代码>

    • ⚠️ 依赖雪球内部服务,当前存在 500 报错风险(服务端问题,非客户端问题)
    • 仅在主接口数据不完整时尝试,失败则告知用户:雪球数据源暂时不可用,已展示东财数据

分时行情(沪深京A股)

  • 接口: GET /api/stock/zh_a_hist_min_em
  • 参数: symbolstart_date(YYYY-MM-DD HH:MM:SS)、end_dateadjust(复权方式:qfq前复权 / hfq后复权 / 空字符串不复权)
  • 展示重点: 时间、开盘、收盘、最高、最低、成交量

模块三:板块分析

行业板块列表(东财)

  • 接口: GET /api/stock/board_industry_name_em
  • 展示重点: 板块排名、涨跌幅、总市值、涨跌家数、领涨股

行业板块实时行情(东财)

  • 接口: GET /api/stock/board_industry_spot_em?symbol=<板块名称>
  • 参数说明: symbol 为板块中文名称,例如 小金属半导体新能源车
  • 展示重点: 当前报价、涨跌幅等 item/value 数据

模块四:异动监控

龙虎榜详情(东财)

  • 接口: GET /api/stock/lhb_detail_em
  • 参数: start_dateend_date(YYYY-MM-DD)
  • 展示重点: 股票代码/名称、上榜原因(rankingReason)、龙虎榜净买额、买卖金额、后续1/2/5/10日涨跌幅

盘口异动(东财)

  • 接口: GET /api/stock/changes_em?symbol=<异动类型>
  • 参数说明: symbol 为异动类型,枚举值如下:
    • 看多信号:火箭发射快速反弹大笔买入封涨停板有大买盘竞价上涨高开5日线向上缺口60日新高60日大幅上涨
    • 看空信号:加速下跌高台跳水大笔卖出封跌停板有大卖盘竞价下跌低开5日线向下缺口60日新低60日大幅下跌
    • 其他:打开跌停板打开涨停板
  • 展示重点: 时间、股票代码/名称、所属板块、异动详情

调用示例(bash_tool — 每次查询都必须执行此步骤)

每次用户提问涉及 A 股数据,必须先用 bash_tool 执行 TypeScript 脚本,再回答。

首次使用:配置 apiKey

# 在项目根目录创建 .env 文件(只需配置一次)
echo "ASTOCK_API_KEY=你的apiKey" >> .env

没有 apiKey?访问 https://aipmedia.cn/ → 登录 → 个人中心 → 查看 API Key


标准调用模式

// 格式:npx tsx <skill目录>/scripts/api-client.ts <endpoint> [JSON参数]

// 示例1:查询上交所市场总貌(无参数)
npx tsx ~/.gemini/skills/a-stock-skill/scripts/api-client.ts /api/stock/sse_summary

// 示例2:查询个股实时行情
npx tsx ~/.gemini/skills/a-stock-skill/scripts/api-client.ts \
  /api/stock/individual_spot '{"symbol":"600519"}'

// 示例3:查询深交所统计(带日期参数)
npx tsx ~/.gemini/skills/a-stock-skill/scripts/api-client.ts \
  /api/stock/szse_summary '{"date":"2026-03-19"}'

// 示例4:查询龙虎榜(带日期范围)
npx tsx ~/.gemini/skills/a-stock-skill/scripts/api-client.ts \
  /api/stock/lhb_detail_em '{"start_date":"2026-03-10","end_date":"2026-03-20"}'

// 示例5:查询盘口异动
npx tsx ~/.gemini/skills/a-stock-skill/scripts/api-client.ts \
  /api/stock/changes_em '{"symbol":"大笔买入"}'

// 示例6:查询行业板块列表(无参数)
npx tsx ~/.gemini/skills/a-stock-skill/scripts/api-client.ts \
  /api/stock/board_industry_name_em

各接口与参数速查

意图endpoint必填参数
上交所总貌/api/stock/sse_summary
深交所统计/api/stock/szse_summarydate
个股信息(东财)/api/stock/individual_info_emsymbol
个股信息(雪球)/api/stock/individual_basic_info_xqsymbol
行情报价/api/stock/bid_ask_emsymbol
实时行情/api/stock/individual_spotsymbol
分时行情/api/stock/zh_a_hist_min_emsymbol
行业板块列表/api/stock/board_industry_name_em
板块实时行情/api/stock/board_industry_spot_emsymbol(板块名)
龙虎榜/api/stock/lhb_detail_emstart_date,end_date
盘口异动/api/stock/changes_emsymbol(异动类型)

返回值处理

脚本成功时直接输出 data 字段的 JSON,失败时打印 ❌ 错误信息并退出。

  • data[{item, value}] 格式时:转为键值对字典后展示
  • 金额字段:以"元"为单位,展示时统一换算为"亿元"(≥1亿)或"万元"(≥1万)
  • 脚本输出 ❌ 未找到 API Key 时:引导用户配置 .env 文件

展示规范

  • 表格优先:多行数据用 Markdown 表格展示
  • 金额换算:> 1亿 换算为"亿元",> 10000 换算为"万元"
  • 涨跌色彩:文字提示涨(+)跌(-),不使用 HTML 颜色标签
  • 数据解读:在表格后附加 1-3 句简明解读,聚焦关键信号
  • 缺失 apiKey:提示用户将 ASTOCK_API_KEY 配置到 .env 文件或环境变量,不得要求用户在聊天窗口中粘贴或输入 API Key,前往 https://aipmedia.cn/ 个人中心获取

参考文档

详细的接口字段说明见 references/api_fields.md

Comments

Loading comments...