ClawHub

财搭子：让你变得更强的投资Agent

v1.0.5

智能股票研究分析工具，应多复杂深度的投资研究问题，支持单资产/多资产/行业对比分析，输出不同维度的机构级拆解结论和专业研究报告。 **高频使用场景** - 财务分析 - 分析营收、利润、ROE、增速、财务健康度等 - 估值分析 - 查阅 PE/PB/PS、股息率，对比历史和行业得到估值水平结论 - 技术面分析 -...

⭐ 0· 155·0 current·0 all-time
by@sunlujing
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
Requires OAuth token
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The skill is an investment-research agent that calls an external service for data. The only required secret is TOOL_API_TOKEN and an optional TOOL_API_URL to override the endpoint (default https://api.facaidazi.com/api/tools/call). The included client script (scripts/tool_client.py) makes HTTP calls to that API, which is coherent with the described functionality.
ℹ
Instruction Scope
Runtime instructions direct the agent to extract assets and forward user queries and asset identifiers to the external API. This is expected for a remote-data research tool, but it means user queries (natural-language questions, stock symbols) are transmitted to a third party. The SKILL.md claims queries are not stored, but that claim cannot be verified from the code and is a privacy consideration.
✓
Install Mechanism
No install spec is provided (instruction-only), and the skill ships a small Python client. There is no download-from-URL or package install. The only runtime dependency is the 'requests' Python package (the script exits if requests is missing), which is normal but not declared in metadata.
✓
Credentials
Only TOOL_API_TOKEN (required) and TOOL_API_URL (optional) are needed. These map directly to an external API bearer token and endpoint — proportionate to the skill's purpose. The token is used as an Authorization: Bearer header in requests.
✓
Persistence & Privilege
The skill does not request elevated platform privileges (always:false). It does not modify other skills or system settings. Its scope of persistence is limited to running the provided client script when invoked.
Assessment
This skill forwards user queries and stock symbols to a third-party API (api.facaidazi.com) using a bearer token (TOOL_API_TOKEN). That is expected for an API-backed research tool, but before installing you should: 1) Confirm you trust the service operator (contact/email is provided) and review their privacy policy; 2) Treat the TOOL_API_TOKEN as a sensitive secret and scope/revoke it if possible; 3) Avoid sending sensitive personal or proprietary data through the skill; 4) Ensure the environment has the Python 'requests' package available or install it in an isolated environment; 5) Be aware the SKILL.md's claim that queries are not stored cannot be verified from the shipped code — if this matters, ask the provider for written guarantees or run analysis in an environment you control.

Like a lobster shell, security has layers — review code before you run it.

Grow Strongervk978t2atjz2wg5cemd1r2r183983wdhkInvest Smartervk978t2atjz2wg5cemd1r2r183983wdhklatestvk97dtyybzvm8cxkbk0rwt698dh84jd1q

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments