OpenD CLI for MooMoo

Agentic trading and market-data workflows for Futu OpenD (MooMoo/Futu OpenAPI), including OpenClaw-compatible secret-ref credential loading, account discover...

This skill appears to do what it says: a local OpenD/Futu (MooMoo) CLI wrapper that supports secret-ref credential loading and simulated or live orders. Before installing or using with real money, do the following: - Inspect and run the code in a safe environment (SIMULATE remains the default) and exercise the simulated trading paths first. - Prefer OPEND_PASSWORD_SECRET_REF / gateway secret injection for hosted deployments; avoid setting MOOMOO_PASSWORD as a plain environment variable in hosted/shared environments. - Verify the registry metadata and packaging: the bundle and SKILL.md document secret env vars, but the registry metadata claimed none — ensure the published registry entry accurately lists the required secrets. - Carefully control OPEND_SDK_PATH: the code will insert that path into sys.path and import moomoo/futu from it. Only point OPEND_SDK_PATH at trusted SDK code; an attacker-controlled SDK path could execute arbitrary code on import. - setup_config.py writes config.key and config.enc locally (key file is written with mode 600). Treat these files as sensitive and move keys into a secret manager if used. - If you intend to run live trading (trd_env=REAL), require explicit user confirmation and validate unlock behavior; consider additional manual review or approval steps in any agent workflow that could invoke live orders. If you are unsure, run the provided smoke test (python3 scripts/release_smoke_test.py) and run the CLI with --help to confirm behavior, and keep live trading disabled until you have audited the environment and credential provisioning.

Type: OpenClaw Skill Name: opend Version: 1.0.1 The skill contains a critical Remote Code Execution (RCE) vulnerability in `opend_core.py`. The `load_sdk()` function allows the `OPEND_SDK_PATH` environment variable to inject arbitrary paths into `sys.path`, enabling the loading and execution of untrusted Python modules if an attacker can control this variable. While `SKILL.md` and `README.md` warn users to only point this at trusted code, the underlying mechanism presents a significant security risk. Additionally, the skill supports legacy credential methods (`env`, `config`, `keyring`) that bypass OpenClaw's preferred secret management, though these are clearly documented as less secure compatibility paths. There is no evidence of intentional malicious behavior, but the RCE vulnerability makes it suspicious.