Stocki

This skill appears internally consistent with its described purpose, but consider these practical safety steps before installing: - Only set STOCKI_API_KEY and STOCKI_GATEWAY_URL if you trust the Stocki service (https://api.stocki.com.cn). The API key grants access to your Stocki account—treat it like a password and prefer a key with limited scope if possible. - The skill will make outbound network requests (to your configured gateway and to raw.githubusercontent.com for version checks) and will create a local workspace (~/stocki/) and downloaded reports. If you run in a sensitive environment, consider installing in a sandbox or container. - The doctor can reinstall itself using clawhub/git and runs an rm -rf on the skill directory after a basic basename check; review the _reinstall_skill() logic if you are concerned about self-updating scripts. - Scheduled monitoring via cron is suggested in SKILL.md—cron jobs will cause periodic outbound queries. Only enable scheduling if you want automated polling. - If you need additional assurance, inspect the full scripts locally (already bundled) and run python3 scripts/stocki.py diagnose to verify behavior with a test API key. Overall: coherent and expected for a gateway-backed financial analysis CLI, but exercise standard caution around API keys, automatic updates, and scheduled tasks.