ETF 波动监控 - 实时跟踪 ETF 涨跌幅，超过阈值自动告警

This skill appears coherent and minimal, but consider these practical cautions before installing or running it: - Network and endpoint: the script queries qt.gtimg.cn over plain HTTP (not HTTPS). That means responses can be intercepted or tampered with on the network. If you run it on an untrusted network, consider using a secure network or an HTTPS proxy. - Rate limits and cron frequency: polling too frequently may hit rate limits or produce unnecessary traffic; follow the README recommendation (>=30s) and be conservative with cron scheduling (e.g., every 5 minutes). - Execution path and privileges: SKILL.md examples reference /root/.openclaw; you should run the script as an unprivileged user and store logs/output in a user-writable directory. Do not run as root unless you intend to and understand implications. - Dependencies: install the 'requests' package in the environment the script will run in (preferably a virtualenv) to avoid affecting system Python packages. - Notifications integration: the skill itself only prints JSON to stdout. If you integrate it with notification tools (QQ, email, webhook), those tools may require credentials — review them separately and ensure they are only granted to trusted integrations. - Code review and trust: the code is short and readable; if you have security concerns, inspect the script locally (it only calls requests.get and prints JSON). Verify the source (homepage points to a generic workspace) and prefer installing from repositories you trust. Overall: coherent and low-risk for typical use, with the main remaining concerns being unencrypted HTTP traffic and safe operational practices (non-root execution, appropriate polling cadence).

Type: OpenClaw Skill Name: etf-monitor Version: 1.0.0 The etf-monitor skill is a legitimate tool for tracking ETF price fluctuations using the public Tencent Finance API (qt.gtimg.cn). The Python script (etf-monitor.py) and documentation (SKILL.md, README.md) contain no evidence of data exfiltration, malicious execution, or prompt injection, and the code logic strictly aligns with the stated purpose of monitoring financial data.