Libu Premarket

礼部侍郎 - A 股盘前作战地图。主力资金流向 + 财务排雷，每天开盘前 3 分钟给你一份实战级选股报告。

Security Scan

The skill largely matches its stated purpose (pre-market stock reports) but includes undocumented payment behavior and mismatches between documentation and package contents that merit caution before installing.

Purpose & Capability

The skill claims 'zero configuration' and no required env vars, but the code implements a local payment flow that expects a CLAWTIP_SM4_KEY environment variable for SM4 encryption/decryption (used in payment_utils.py). That credential and the payment implementation are not declared in manifest.required_env_vars or in the top-level SKILL metadata, which is an incoherence between stated purpose/requirements and actual capabilities.

Instruction Scope

SKILL.md promises an out‑of‑the‑box Lite experience and mentions auto-extraction of an initial_data.zip, but the distributed file list does not include initial_data.zip. The runtime code will (a) attempt to extract initial_data.zip if present, (b) perform network calls to third-party endpoints (Tencent/Sina) for market data, and (c) create/read/write order files under ~/.openclaw/skills/orders and output JSON under ~/.openclaw/workspace/cron_outputs — these side effects and missing packaged data contradict the 'zero config / upfront claim' and should be noted.

Install Mechanism

There is no external install/download action in the package (no install spec). The code is delivered in-repo; dependencies are standard Python packages listed in requirements.txt. No remote, opaque installer URLs are used.

Credentials

Manifest lists permissions including env:read, file:read_write and network:outbound (consistent), but the SKILL.md and manifest declare no required env vars while code requires/reads TUSHARE_TOKEN (optional) and CLAWTIP_SM4_KEY (used for payment encryption/verification). Requesting a cryptographic key for payments is plausible, but it is undocumented and not declared as a required environment variable — this is disproportionate and should be explicit to users.

Persistence & Privilege

The skill does not force persistent installation (always:false). It reads/writes under the user's home (~/.openclaw), creating orders and cache files and writing pre_market_data.json to a workspace path. Those activities are expected for a local reporting/payment flow, but users should be aware the skill will create and modify files under ~/.openclaw/ (orders, cache, outputs).

What to consider before installing

This skill appears to implement the promised pre-market report functionality, but there are important mismatches you should consider before installing: - Undeclared payment key: payment_utils.py requires CLAWTIP_SM4_KEY (an SM4 key) from the environment to encrypt/decrypt payment credentials. The SKILL metadata and README do not list this env var as required. If you do not trust the developer or the origin of the key, do not set it in your environment. - Missing packaged data: SKILL.md says an initial_data.zip will be auto-extracted on first run, but the package manifest provided to you does not include that zip. Expect the skill to fallback to network downloads; if you run it offline you may get limited output. - File writes: the skill will create/read/write files under ~/.openclaw (orders, cache, outputs). Review or sandbox these directories if you are concerned about data written to your home directory. - Network access: the code fetches market data from public endpoints (Tencent/Sina) and optionally uses Tushare if you provide TUSHARE_TOKEN. Ensure you are comfortable with outbound network calls and the endpoints used. - Dependency/behavior check: the script requires gmssl for SM4 operations. Even in 'Lite' mode the package asks you to install it. Consider running the code in an isolated environment (container or VM), inspect payment-related code (payment_utils.py) and confirm the payment flow and key handling before supplying any sensitive environment variables. If you want to proceed, request the developer to (1) explicitly declare CLAWTIP_SM4_KEY in the manifest and SKILL.md, (2) include or remove references to initial_data.zip so documentation matches package contents, and (3) explain the payment flow and where the SM4 key should come from. If that information is not available or satisfactory, treat this skill with caution or run it in a sandbox.

📈 礼部侍郎 - 盘前作战地图

每天早上开盘前，一份属于你的 A 股核心作战地图。 不看无脑涨停，只看真金白银的主力资金流向。

---

🎁 免费开箱即用 — Lite 模式零门槛

不用注册、不用配置、不用付费。 安装后直接运行，免费获取：

• 🌍 全球市场概览 — A50 / 美股 / 港股 / 黄金 / 原油隔夜表现，一眼看清开盘情绪
• 🔥 昨日热点复盘 — 昨日主力净流入 Top 5 板块 + 热门个股回顾

💡 零配置开箱即用：内置近期数据缓存，首次运行即可体验。不需要 Tushare Token，不需要任何密钥。

---

💎 解锁完整版 — AI 选股 + 财务排雷

支付后解锁以下核心能力：

功能	说明
🎯 AI 智能选股	从 4500+ 股票中，通过「财务增速 + 资金共振 + 技术面」三重过滤，输出 Top 10 潜力标的
⚡ 财务排雷	自动筛除业绩暴雷、负债过高、现金流异常的个股，帮你避开隐形坑
⚔️ 操盘建议	基于资金博弈的实战建议：哪些该追、哪些该躲、哪些该观望

💰 付费方案

方案	价格	适合谁
🔹 单次体验	¥0.8/次	偶尔看看，按需付费
🔥 月度订阅	¥9.9/月	每天开盘前自动刷新，最划算

☕ 一杯奶茶钱，换每天 30 天精准选股报告。

---

🚀 3 分钟快速上手

第 1 步：安装

npx clawhub@latest install libu-premarket

第 2 步：运行（免费 Lite 模式）

python3 pre_market.py

就这么简单。零配置，直接出报告。

⚠️ 首次运行需要安装依赖：pip3 install gmssl

第 3 步：（可选）解锁完整版

想获取 AI 选股和财务排雷？运行脚本后会自动创建支付订单，按提示完成支付即可解锁。首次使用需京东 App 扫码授权钱包（仅一次）。

第 4 步：（可选）配置 Tushare Token

想获取实时财务数据？在 Tushare Pro 免费注册获取 Token，配置后数据更精准：

export TUSHARE_TOKEN="你的token"

---

📊 报告长什么样？

每次运行自动生成 pre_market_data.json，你的 AI Agent 基于数据为你输出：

🌍 外围风向：A50期指 -0.2%，美股三大指数涨跌互现，纳斯达克 +0.5%
   → 开盘情绪偏中性，关注科技股延续性

🔥 今日主线：主力净流入 Top 5 板块
   1. 半导体（+32亿）▎量价齐升，重点关注存储芯片方向
   2. 新能源车（+18亿）▎政策利好持续发酵
   3. ...

🎯 重点关注（Top 5）
   • XX股份（000XXX）：净利润增速 45% + 主力连续3日净流入 + MACD金叉
   • XX科技（688XXX）：ROE 15.2% + 突破年线压力位
   • ...

⚔️ 操盘建议
   → 进攻方向：半导体存储、新能源车零部件
   → 回避方向：前期涨幅过大的AI应用概念
   → 仓位建议：6-7成，关注早盘前30分钟量能

---

⚙️ 进阶配置

编辑 config.json 可调整选股标准：

{
  "filter_financial": {
    "min_netprofit_yoy": 0.30,   // 净利润增速 ≥30%
    "min_roe": 8                  // ROE ≥8%
  },
  "cache": {
    "root_dir": "./cache_data"
  }
}

---

🔄 数据更新

• 首次运行：自动解压内置 initial_data.zip（含近期财务/收盘数据）
• 定期更新：开发者每周/月发布新版 Skill，重新 install 即可刷新数据包
• 本地缓存：运行产生的数据保存在 ./cache_data/，下次优先读取，秒级出报告

---

⚠️ 注意事项

• 本工具仅供数据参考，不构成任何投资建议。股市有风险，入市需谨慎。
• 运行环境：Python 3.8+，依赖 pandas、requests、numpy、gmssl
• 完整版支付依赖京东 ClawTip 微支付系统，支持单次 / 月度订阅

---

🆘 售后支持

方式	说明
微信	添加 ygbeyond 进专属交流群
Bug 修复	24 小时内响应
数据更新	群公告 / 朋友圈第一时间通知

---

📝 更新日志

v13.4.0 — Lite 模式 + 核心安全重构

• 🎁 新增 Lite 模式：无需配置密钥，免费运行获取全球市场概览与昨日复盘
• 🔐 支付系统安全重构：SM4 密钥改为纯环境变量，代码零硬编码
• ✨ 首次运行体验优化：零门槛开箱即用，未解锁完整版时引导更友好
• 📖 文档全面更新：快速开始流程简化，报告示例更直观

v13.3.0 — 零配置体验

• 开箱即用：安装即运行，无需环境变量
• 先用后付：未支付自动进入 Lite 模式

v13.2.0 — 安全加固

• 修复环境变量绕过漏洞