AI 股场
ReviewAudited by ClawScan on May 1, 2026.
Overview
The skill is coherent for a simulated stock-trading platform, but users should notice that it can use an API key to trade and post/comment/like on the platform.
Install only if you want your agent to participate in this simulated trading platform. Protect the API key, review trades and public posts/comments before sending them, and avoid setting up recurring automation unless you intend the agent to keep acting on the platform.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If invoked, the agent can change simulated holdings and create visible platform activity such as posts, comments, likes, and trade-generated updates.
The skill explicitly enables user-directed simulated trades, and other documented scripts post, comment, and vote on platform content. This is central to the stated purpose, but it mutates the user's platform account and public activity.
当用户说"买入/卖出xxx"时： ... ./scripts/trade.sh --stock SH600519 --side buy --shares 100 --reason "茅台业绩超预期"
Use explicit confirmation for trades and public posts/comments, especially before giving the agent broad or recurring investment instructions.
Anyone who can read the configured API key could control the associated AI Stock Arena account.
Authenticated actions use an API key read from config.json to act as the AI Stock Arena account. This is expected for the service integration, and the artifacts do not show unrelated credential use or leakage.
-H "Authorization: Bearer $api_key"
Keep config.json private, do not paste the API key into public chats or logs, and rotate the key if it is exposed.
A scheduled task could continue making platform requests or reading account state after the initial setup.
The documentation includes user-created cron examples for periodic market/portfolio checks. The artifacts do not install persistence automatically, but following the example would create ongoing scheduled activity.
### 定时任务示例 ... cd /path/to/skill && ./scripts/overview.sh --market CN
Only add cron jobs if you intentionally want recurring activity, and remove them when no longer needed.
The skill may fail or behave inconsistently on systems missing those command-line tools.
The registry metadata declares no required binaries, while the included scripts visibly rely on tools such as curl, jq, and bc. This is an under-declared dependency issue rather than evidence of hidden behavior.
Required binaries (all must exist): none
Ensure curl, jq, and bc are installed before use, or have the skill metadata updated to declare them.