Dolphindb Skills

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill appears to be a coherent DolphinDB helper suite, but users should know it can run local setup scripts, install the DolphinDB Python package, connect with broad database privileges in examples, and includes maintenance scripts that can rewrite related DolphinDB skill files if run.

This skill is reasonable for DolphinDB users, but install and use it with normal database-administration caution: review setup scripts before sourcing them, prefer a virtual environment for SDK installation, do not use default admin credentials on real systems, and require confirmation before destructive database commands.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

First use may modify a local Python environment by installing a package.

Why it was flagged

The environment-detection script can install the DolphinDB Python package automatically if it does not find an existing SDK. This is purpose-aligned, but it is an unpinned package install that changes the local Python environment.

Skill content

$TARGET_PYTHON -m pip install dolphindb --quiet 2>/dev/null

Recommendation

Run the setup step intentionally, preferably in a virtual environment, and consider pinning or reviewing the DolphinDB SDK version before installation.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

If the agent runs destructive DolphinDB commands against the wrong database, data could be changed or removed.

Why it was flagged

The skill explicitly supports destructive DolphinDB operations such as DELETE and DROP. That fits a database administration skill, but mistakes could delete data.

Skill content

| **删除数据** | DELETE、DROP 表/数据库、删除分区 |

Recommendation

Ask the agent to show planned DELETE, UPDATE, DROP, or bulk-write commands first, and keep backups for important DolphinDB data.

Low

#ASI03: Identity and Privilege Abuse

What this means

Using default admin credentials can give the agent broad control over the DolphinDB instance.

Why it was flagged

The examples use a local default admin login. This appears to be sample DolphinDB usage rather than stolen credentials, but admin access is broad if copied into a real deployment.

Skill content

session.connect(
    host='localhost', 
    port=8848, 
    userid='admin', 
    password='123456'
)

Recommendation

Replace example credentials with a least-privilege DolphinDB user and avoid using default passwords on production or shared servers.

Low

#ASI08: Cascading Failures

What this means

Running this helper can alter multiple installed DolphinDB-related skills, which could affect future agent behavior.

Why it was flagged

This maintenance script can rewrite SKILL.md files for related DolphinDB subskills under the OpenClaw skills workspace. It is scoped and disclosed, but it persistently changes agent instructions if run.

Skill content

SUBSKILLS = [
    "dolphindb-basic",
    "dolphindb-docker", 
    "dolphindb-streaming",
    "dolphindb-quant-finance"
]
...
with open(skill_path, 'w', encoding='utf-8') as f:
        f.write(new_content)

Recommendation

Only run maintenance/update scripts intentionally; add backups, confirmation prompts, and idempotence checks before rewriting installed skill files.