Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for thatshinji/trading-plan-generator.
Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "基于 Brent Penfold《交易圣经》框架，为股票交易生成完整的交易预案（Setup）和交易计划（Plan）。当用户询问「帮我制定交易计划」、「帮我做交易预案」、「XX股票怎么买」、「帮我规划一下XX股票的入场和止损」时使用此技能。触发前提：用户明确指定了具体股票代码或名称" (thatshinji/trading-plan-generator) from ClawHub.
Skill page: https://clawhub.ai/thatshinji/trading-plan-generator
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.
Command Line
CLI Commands
Use the direct CLI path if you want to install manually and keep every step visible.
The skill claims to generate trading setups/plans (Brent Penfold framework) which legitimately requires market quotes, news and fundamentals. However, the skill metadata declares no required binaries or credentials, while the runtime instructions explicitly call the 'longbridge' CLI and specific Python scripts located under ~/.openclaw/workspace/skills/问财选A股/... and 问财选美股/.... This mismatch (declaring nothing required but assuming presence of specific tools and other skills' code) is incoherent and fragile — the external CLIs and local scripts are necessary for its stated purpose and should be declared.
!
Instruction Scope
The SKILL.md requires running commands that fetch market quotes, klines and news (longbridge quote/kline/news) and executing local Python CLI scripts in another skill's workspace to get fundamentals. These instructions will access local files (paths under the user's home and the agent workspace) and call external services. While these actions align with building a trading plan, they also grant the skill the ability to read files in ~/.openclaw/workspace/skills/... (other skills' code/config) and to make network calls — the skill does not document or limit which credentials or data are used. No step in the metadata documents these file/command dependencies.
✓
Install Mechanism
This is an instruction-only skill with no install spec and no code files to execute as part of installation, which is low-risk from an install-mechanism perspective.
!
Credentials
The skill declares no required environment variables or primary credentials, but the commands it instructs (longbridge CLI and the referenced Python CLIs) almost certainly require API keys or other credentials to access market/news/fundamental data. It also references exact local skill paths that may contain secrets or tokens belonging to other skills. The absence of declared credentials is a proportionality and transparency problem.
✓
Persistence & Privilege
The skill is not 'always' enabled and does not request system-wide persistent privileges in the metadata. It does not declare writing to other skills' configurations. Autonomous invocation is allowed (platform default) but not by itself a reason to flag; combined with the above concerns it increases the importance of careful credential/access controls.
What to consider before installing
Before installing or enabling this skill, verify the following: (1) Confirm you have the longbridge CLI and the referenced Python CLI scripts available and inspect their sources — the SKILL.md directly calls longbridge and python scripts under ~/.openclaw/workspace/skills/... which may require API keys and could read other files. (2) Ask the skill author to update metadata: declare required binaries (e.g., longbridge, python), required environment variables/API keys, and any config path access. (3) Inspect the referenced Python scripts for unexpected file/network access or secrets usage. (4) Provide the minimal, read-only API credentials needed (if any) and consider running the skill in a sandboxed environment or with limited agent permissions. (5) If you don't control the referenced local scripts, do not grant the agent broad filesystem access — require the skill be modified to call documented, audited APIs rather than arbitrary local paths.
Like a lobster shell, security has layers — review code before you run it.
