A股实时热度排名TOP50

[Python版本] 获取A股股票实时热度排名TOP50。聚合问财、雪球、东方财富三大平台人气榜单。适用场景：用户询问A股热门股票、股票热度排名、股票人气排名、市场关注度排行、热门股票榜单、最受关注股票、实时股票排名、今日热门股。关键词：A股热度、股票热度排名、人气排名、热门股票、股票人气榜、关注度排行、热门股、...

This skill appears to do what it says (aggregate popularity lists and compute a composite TOP50), but there are two practical concerns you should address before installing or running it: 1) The Python metadata omits a required Node.js dependency even though main.py runs the included lib/hexin_v.js with 'node'—ensure Node.js is installed and available on PATH. 2) lib/hexin_v.js is heavily obfuscated and requires Node modules (jsdom, Canvas) and possibly native build tools; review that JS carefully for hidden endpoints or behavior and run the skill in an isolated environment (container/VM) if you plan to execute it. Recommended actions: inspect the full hexin_v.js contents, ask the publisher to add explicit install steps for Node/npm (including npm install for jsdom/canvas and any native deps), and verify network targets and scraping legality/ToS for iwencai/xueqiu/eastmoney. If you cannot audit the obfuscated JS, avoid running it on sensitive systems.

Type: OpenClaw Skill Name: stock-heat-rank-py Version: 1.0.0 The skill bundle contains a heavily obfuscated JavaScript file (`lib/hexin_v.js`) which is executed by the main Python script (`main.py`) using `subprocess.run`. This JS file appears to be a signature generator for bypassing anti-bot protections on the Wencai financial platform, a common but risky practice. While the Python code itself is straightforward and lacks clear malicious intent (such as credential theft or data exfiltration), the use of extreme obfuscation and the execution of an external runtime (Node.js) to process a 'black box' script makes the bundle suspicious according to security best practices.