A 股大师 Pro

A 股智能盯盘与选股系统，基于 QVeris AI 数据源。提供持仓监控（10 分钟自动检查）、实时预警、午盘/尾盘复盘、趋势选股等功能。支持创业板和主板（不含科创板）。 使用方式： - 对话触发：用户说"午盘复盘"、"我的持仓"、"帮我选股"等 - Web 界面：访问 file:///home/yaoha/.o...

What to check before installing: - Verify the QVeris domain and source files: the instructions ask you to curl scripts from https://qveris.ai — confirm that domain is the legitimate provider and inspect any downloaded scripts before saving/executing them. - Treat the example API key in INSTALL_SUMMARY.md as suspicious: do not copy it into your environment. The presence of a long-looking key in the docs contradicts claims of 'no hardcoded API Key' and could be an accidental leak or placeholder; if you see a key already present in files, do not trust it. - Avoid embedding your API key directly in crontab or world-readable shell files. Use a safer secret storage method (user-only shell rc or OS secret manager) and ensure file permissions are restrictive. - Inspect all scripts (scripts/*.mjs, web/*.js, package.sh, start-web.sh) before running them, paying attention to any network calls (other than QVeris), file writes outside the skill directory, or attempts to execute arbitrary commands. - Because many docs and scripts use absolute paths with username 'yaoha', update paths to your user/home and verify scripts reference only expected local directories (e.g., ~/.openclaw/workspace/skills/stock-master-pro) rather than system-wide locations. - If you plan to allow the agent to run autonomously, be extra cautious: the skill instructs downloads and cron setup which would give long‑running local behavior. Consider running initially in a sandbox or manual mode and verify behavior before enabling automation. If you want, I can: (1) list the exact places where an API key or absolute path appears in the files, (2) highlight all curl/download commands and remote URLs, or (3) produce a short checklist of which files to inspect first.

Type: OpenClaw Skill Name: stock-master-pro Version: 0.0.1 The skill bundle exhibits several high-risk patterns, primarily the extensive use of `execSync` to execute shell commands in multiple scripts (e.g., `aggregate_data.mjs`, `check_holdings.mjs`, and `market_review.mjs`), which presents a significant shell injection surface. Furthermore, the `SKILL.md` and `INSTALL.md` files contain instructions for the AI agent to prompt users to download and execute remote scripts from a third-party domain (`qveris.ai`) using `curl`, posing a substantial supply chain risk. While the code appears functionally aligned with its stated purpose of stock monitoring and utilizes a required `QVERIS_API_KEY`, the combination of unvalidated shell execution and the promotion of insecure installation practices warrants a suspicious classification.