Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

xqant daily market report

v1.0.0

每日15:30生成大盘走势、行业涨跌、债券市场及固收+赛道预测的市场简报,含风险提示和成交量分析。

0· 89·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (daily market report, 固收+赛道预测) aligns with the SKILL.md and references to Wind data and specific index/bond codes are coherent with that purpose. However, the skill expects access to Wind 'run_function' data and a specific product pool (STANDARD/蚂蚁固收 + 竞品清单 (最终版).md) and execution specs that are not included in the package or declared as required resources—this is a design gap rather than direct maliciousness.
!
Instruction Scope
Instructions explicitly call platform data queries via run_function(...) for Wind and reference local/standard files (STANDARD/..., MEMORY.md). The skill does not instruct broad data harvesting, but it implicitly requires access to proprietary data sources and local documents. Because these referenced files are not bundled and no authentication details are declared, the agent may need to access external credentials or local files to fulfill the workflow—this is a scope/integration mismatch to be resolved.
Install Mechanism
This is instruction-only with no install spec and no code files—there is nothing written to disk or downloaded by the skill itself, which reduces surface risk.
!
Credentials
The skill uses Wind data functions but declares no required environment variables or primary credential. Wind and other market data providers normally require credentials; the lack of declared credentials or explanation of how run_function is authenticated is a proportionality mismatch. Also, the skill depends on an internal product list (87 products) and execution guidelines that are not provided—these may require access to private files or memory.
Persistence & Privilege
always:false and no install hooks are present. The skill does not request permanent presence or elevated privileges in the manifest. Autonomous invocation is allowed (platform default) but is not combined here with other strong red flags.
What to consider before installing
This skill appears to be what it says (a daily 15:30 market report), but there are some practical/integration gaps you should check before installing: - Data access: The instructions assume Wind-style run_function(...) queries. Confirm whether your agent environment already has authenticated access to Wind or another provider; the skill does not declare or request any credentials. If Wind access requires API keys or a licensed data connector, the agent may fail or prompt for credentials. - Missing reference files: The SKILL.md requires specific local files (e.g., STANDARD/蚂蚁固收 + 竞品清单 (最终版).md and execution-spec docs). Those files are not included. Ask where those should come from and whether the agent will read files from your workspace or account MEMORY. If you don't want the agent to access private files, do not grant it blanket file access. - Sensitive data exposure: Because the skill may need to read local product lists or MEMORY.md, ensure you understand what those files contain and that they don't include secrets. The skill itself doesn't explicitly request credentials, but it may rely on platform-managed credentials or require you to paste sensitive API keys into the environment later. - Operational check: If you plan to use it, verify in a safe environment that the data sources return expected results and that generation logic uses only intended inputs. If unclear, ask the skill author (or your ops team) to supply the missing STANDARD documents and to document how Wind access is authorized. Given these inconsistencies, treat the skill with caution until integration points (data credentials and referenced files) are resolved.

Like a lobster shell, security has layers — review code before you run it.

latestvk975af3j23htn02zt2w6fas71d83her9

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments