Stock Tracker Pro

股票监控技能。使用 Yahoo Finance 获取股票数据。支持添加股票到监控列表、删除股票、查询股票信息。触发场景：(1) 添加股票如"监控 AAPL"，(2) 删除股票如"删除 TSLA"，(3) 查询股票如"查看腾讯股票"、"AAPL 股价"。

This skill mostly matches its description (fetches Yahoo Finance data and manages a local watchlist), but it also runs a hardcoded local script at /home/frank/.openclaw/workspace/skills/openclaw-tavily-search/scripts/tavily_search.py to collect news. That behavior is not documented in SKILL.md and lets the skill execute arbitrary code present elsewhere in your workspace. Before installing: (1) inspect the included scripts, especially get_stock_info.py and the referenced tavily_search.py if it exists; (2) if you don't trust the owner or that external tavily script, remove or sandbox the subprocess call; (3) be cautious running this on systems with sensitive data — the skill could leverage other workspace scripts to access secrets or network resources; (4) ensure Python dependencies (e.g., requests) are managed in a controlled environment; (5) prefer installing only from a trusted source or ask the publisher to remove the hardcoded cross-skill execution and to document any external dependencies. If you want, I can show the exact lines that call the external script and suggest a safer replacement (e.g., fetch news over HTTPS from a known API).

Type: OpenClaw Skill Name: stock-tracker-pro Version: 1.1.0 The stock-tracker-pro skill provides legitimate functionality for monitoring stock prices and news using Yahoo Finance and a secondary search script. The Python scripts (get_stock_info.py and stock_manager.py) implement standard data fetching and local JSON management. While the code contains hardcoded absolute paths (referencing a user 'frank') and relies on an external search skill, it lacks any indicators of malicious intent, data exfiltration, or shell injection vulnerabilities.