Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name, description, SKILL.md and the included Python script all align: the script fetches ETF quotes from Tencent Finance (qt.gtimg.cn), computes percent change against last close, and emits alerts when threshold is exceeded. No unrelated binaries, credentials, or config paths are requested.
Instruction Scope
Runtime instructions tell the agent/user to run the included Python script and optionally add a cron job. The script makes outbound HTTP requests to qt.gtimg.cn and prints JSON alerts to stdout. Notes: the SKILL.md examples use a hard-coded example path under /root/.openclaw which may not match target environments; the Tencent API endpoint is accessed over HTTP (not HTTPS), which allows potential MITM or eavesdropping on requests/responses.
Install Mechanism
No install spec; it's an instruction-only skill with a single Python script. Metadata notes pip dependency 'requests' which matches the code's import. No remote downloads, no archive extraction, and no unusual installers.
Credentials
The skill requires no environment variables, no credentials, and does not read system config paths. The requested resources are proportionate to a simple market-monitoring script.
Persistence & Privilege
always is false, model invocation is normal. The skill does not attempt to modify other skills, system-wide agent settings, or persist credentials. Running it as a cron job is a user action, not forced by the skill.
Assessment
This skill appears coherent and minimal, but consider these practical cautions before installing or running it:
- Network and endpoint: the script queries qt.gtimg.cn over plain HTTP (not HTTPS). That means responses can be intercepted or tampered with on the network. If you run it on an untrusted network, consider using a secure network or an HTTPS proxy.
- Rate limits and cron frequency: polling too frequently may hit rate limits or produce unnecessary traffic; follow the README recommendation (>=30s) and be conservative with cron scheduling (e.g., every 5 minutes).
- Execution path and privileges: SKILL.md examples reference /root/.openclaw; you should run the script as an unprivileged user and store logs/output in a user-writable directory. Do not run as root unless you intend to and understand implications.
- Dependencies: install the 'requests' package in the environment the script will run in (preferably a virtualenv) to avoid affecting system Python packages.
- Notifications integration: the skill itself only prints JSON to stdout. If you integrate it with notification tools (QQ, email, webhook), those tools may require credentials — review them separately and ensure they are only granted to trusted integrations.
- Code review and trust: the code is short and readable; if you have security concerns, inspect the script locally (it only calls requests.get and prints JSON). Verify the source (homepage points to a generic workspace) and prefer installing from repositories you trust.
Overall: coherent and low-risk for typical use, with the main remaining concerns being unencrypted HTTP traffic and safe operational practices (non-root execution, appropriate polling cadence).Like a lobster shell, security has layers — review code before you run it.
latestvk97e9d38d1axhp8dtdx7n63899835xgb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📊 Clawdis