stock-analysis-lianghua

分析任意股票的技术指标和趋势，或修改 TradingAgentsV2 中的分析师节点。当用户需要分析某只股票、查看技术指标、获取市场趋势判断时，使用独立分析脚本；当需要新增/修改分析师节点时，参考架构模板。

This skill appears to do what it says: it fetches market data from public endpoints, computes indicators, and provides templates for LangGraph analyst nodes. Before enabling or running it: 1) review the included analyze_stock.py yourself (it runs HTTP requests and writes cache files to local project paths); 2) ensure you are comfortable the agent can modify files in your project (SKILL.md shows node-editing guidance); 3) install required Python packages in an isolated environment (virtualenv/container) to limit impact; 4) if you need to restrict network access, run the script in an environment without outbound HTTP or inspect logs; and 5) there are no secrets requested by the skill, so you don't need to provide API keys for normal operation.

Type: OpenClaw Skill Name: stock-analysis-lianghua Version: 1.0.0 The `analyze_stock.py` script contains a path traversal vulnerability in its caching mechanism. The `_find_cached_file` and `_save_cache` functions use the user-provided `symbol` directly in `os.path.join` to construct file paths. This allows an attacker to potentially read or write files to arbitrary locations on the system by injecting path traversal sequences (e.g., `../`) into the stock symbol. Additionally, the `SKILL.md` describes a LangGraph agent architecture where user input (`ticker`) is directly embedded into the LLM's system prompt, posing a prompt injection risk to the agent itself.