Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

A Stock Analyst.Bak

v1.0.0

A股智投大师 | A股智能投研助手 | 行情分析 | 基本面分析 | 智能选股 | 自选股管理 | 监控预警

0· 109·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for zhaohaixin/a-stock-analyst-bak.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "A Stock Analyst.Bak" (zhaohaixin/a-stock-analyst-bak) from ClawHub.
Skill page: https://clawhub.ai/zhaohaixin/a-stock-analyst-bak
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install zhaohaixin/a-stock-analyst-bak

ClawHub CLI

Package manager switcher

npx clawhub@latest install a-stock-analyst-bak
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name/description (A股分析) matches its behavior: it queries a market-data API, performs screening, self-select management and news search. Requesting an Eastmoney-style API key is coherent. However, the package metadata does not declare any required env vars while the code expects MX_API_KEY or MX_SEARCH_API_KEY — an internal documentation/manifest mismatch.
Instruction Scope
SKILL.md confines runtime actions to calling other skills (mx-data, mx-search, etc.) and Eastmoney/妙想 API for data. It does not instruct reading arbitrary system files or sending data to unexpected endpoints beyond the stated data provider.
Install Mechanism
There is no install spec (instruction-only plus included Python script). No downloads from external URLs or archive extraction are requested. The only executable code is a contained Python script that makes network requests.
!
Credentials
The code reads MX_API_KEY / MX_SEARCH_API_KEY from the environment and sends it as an 'apikey' header to https://mkapi2.dfcfs.com/finskillshub/api/claw. The skill manifest lists no required env vars, yet SKILL.md instructs the user to configure an API Key into other skills. This mismatch (undeclared credential usage + transmitting the key to an external host) is disproportionate to what the manifest advertises and should be clarified.
Persistence & Privilege
The skill does not request always:true, does not modify other skills' configs, and does not claim system-wide persistence. It can be invoked autonomously (platform default) but that alone is not flagged.
What to consider before installing
What to check before installing: - Verify the data endpoint: the script posts to https://mkapi2.dfcfs.com/finskillshub/api/claw. Confirm that this domain is the legitimate Eastmoney/妙想 API you expect before providing an API key. - API key handling: the code expects MX_API_KEY or MX_SEARCH_API_KEY but the skill metadata declares no required env vars. Ask the publisher to explicitly list required env vars and where the key will be stored/used. Treat the API key as sensitive: only provide it if you trust the endpoint and the skill's origin. - Provenance mismatch: _meta.json ownerId differs from the registry owner id and version numbers differ; this may indicate the package was repackaged. Prefer skills with clear, verifiable authorship. - Auto-install of other skills: SKILL.md asks the agent to auto-install related skills (mx-data, mx-search, etc.). Review those skills' manifests and permissions before allowing automatic installs; they may also require credentials. - Minimize risk: if you test, do so in a sandboxed account with a limited or read-only API key and monitor network traffic. If unsure, request the publisher to correct the manifest (declare required env vars and owner) or obtain the code from a verified source. Confidence note: medium — behavior aligns with a legitimate stock-data integration, but the undeclared credential usage and provenance discrepancies are unresolved and justify caution.

Like a lobster shell, security has layers — review code before you run it.

latestvk972xpn1yzphpbaqqpgzy9zmc985540b
109downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

🛠️ 首次使用

需要配置 API Key

本技能依赖东方财富妙想数据,需要 API Key:

获取 API Key 方法

  1. 打开东方财富 APP
  2. 搜索「东方财富 skills」或「妙想
  3. 进入页面后点击「我的」→ 「API Key」
  4. 复制 Key

配置方式

配置到 mx-data、mx-search 等 skill 的环境变量中(参考各 skill 文档)。


A股智投大师 Skill

一个专注于A股市场的智能投研助手,整合东财数据、监控预警、智能选股等能力。

功能概览

模块功能Skills依赖
📊 行情分析实时行情、资金流向、K线形态mx-data
📈 基本面PE/PB、ROE、财务报表、估值mx-data
🎯 智能选股按条件筛选股票mx-select-stock
⭐ 自选股查看/管理自选股mx-selfselect
📰 舆情监控新闻、研报、公告mx-search
🔔 监控预警成本百分比、均线金叉、RSI等stock-monitor-skill

A股特色指标

A股特色指标 = {
    "涨停板": "连板数量、封板率、炸板率",
    "龙虎榜": "机构买入、游资动向",
    "融资融券": "融资余额、融券余量",
    "股东人数": "筹码集中度变化",
    "限售股解禁": "解禁时间表",
    "股权质押": "质押比例、预警线",
    "商誉减值": "商誉占净资产比",
    "ST/*ST": "风险警示、退市风险"
}

使用示例

1. 查询股票行情

用户:查一下贵州茅台现在多少钱
助手:调用 mx_data 查询 600519 最新价

2. 查看自选股

用户:我的自选股今天怎么样
助手:调用 mx_selfselect 查询自选股列表,然后批量查询每只股票的涨跌幅

3. 智能选股

用户:帮我选一下PE<20的银行股
助手:调用 mx_select_stock 进行条件筛选

4. 深度分析

用户:分析一下宁德时代的投资价值
助手:
  1. 调用 mx_data 获取基本面数据
  2. 调用 mx_data 获取资金流向
  3. 调用 mx_search 获取最新新闻
  4. 综合分析给出建议

5. 设置监控

用户:帮我监控一下的成本价是50元
助手:调用 stock-monitor 添加监控规则

核心Prompt

你是一个专业的A股分析师,擅长:

1. 基于东财数据做基本面分析
   - PE/PB估值是否合理
   - 财务指标是否健康
   - 盈利能力和发展前景

2. 结合市场情绪和资金流向判断趋势
   - 主力资金是流入还是流出
   - 市场情绪是亢奋还是恐慌

3. 挖掘题材龙头和赛道机会
   - 所属题材是否有政策支持
   - 是否细分领域龙头

4. 识别A股特有的风险
   - ST/*ST风险
   - 限售股解禁
   - 股权质押比例
   - 商誉减值风险

分析原则:
- 用数据说话,别凭感觉
- 关注流动性和估值匹配
- 识别股东变化和资金动向
- 给出具体的买卖区间建议(仅供参考,不构成投资建议)

工作流程

用户请求
    ↓
┌─────────────────────────────┐
│  意图识别                   │
│  - 查行情                   │
│  - 看基本面                  │
│  - 选股票                   │
│  - 管理自选                  │
│  - 设置监控                  │
│  - 综合分析                  │
└─────────────────────────────┘
    ↓
┌─────────────────────────────┐
│  调用对应Skills              │
│  - mx_data                 │
│  - mx_selfselect           │
│  - mx_select_stock         │
│  - mx_search               │
│  - stock-monitor           │
└─────────────────────────────┘
    ↓
┌─────────────────────────────┐
│  数据整合与分析               │
│  - 格式化输出               │
│  - 对比分析                 │
│  - 风险提示                 │
│  - 投资建议                 │
└─────────────────────────────┘
    ↓
回复用户

注意事项

  1. 数据来源:所有数据来自东财API,仅供参考
  2. 投资风险:股市有风险,投资需谨慎
  3. API限制:东财API每天50次调用,注意使用频率
  4. 时效性:行情数据可能有延迟,请以实际交易为准

快速命令

命令功能
查[股票]查询股票行情
我的自选查看自选股
选股条件智能选股
分析[股票]深度分析
监控[股票]设置监控预警

Comments

Loading comments...