stock trading agents

基于 AgentScope 的多智能体股票诊断系统。一键执行完整诊断流程，自动生成技术面、基本面、舆情面分析、研究员辩论、交易员决策、风控讨论及最终投资决策报告。

This package appears to do what it says: it fetches market data (Tushare/AKShare), sends prompts and data to a remote LLM service (DashScope/Aliyun using the ALIYUN_BAILIAN_API_KEY), and writes reports to disk. Before installing: (1) Inspect scripts/config.py to confirm which environment variables are read and how LLM_API_KEY is assembled; (2) treat the provided API keys as sensitive — use keys with minimal privileges and do not reuse high-value platform keys; (3) expect network traffic to Tushare/AKShare endpoints and dashscope.aliyuncs.com; run the skill in an isolated environment or sandbox first; (4) note that setup.py will install many third‑party packages from PyPI — verify dependency versions if you have supply-chain concerns; (5) SKILL.md references BACKGROUND_RULES.md which isn't present in the manifest shown — check for any missing docs. If you need the skill to never send data outside your environment, do not provide the ALIYUN_BAILIAN_API_KEY or run it with a local/no-network configuration.

Type: OpenClaw Skill Name: trading-agents Version: 1.0.7 The `trading-agents` skill bundle is classified as suspicious due to the presence of high-risk capabilities, specifically runtime shell execution and extensive network access. In `scripts/stock_advisor.py`, the system uses `subprocess.check_call` to execute `pip install fpdf2` if the library is missing, which constitutes an auto-installation of remote code at runtime. Additionally, the bundle performs extensive network operations, including fetching financial data from Tushare and AKShare APIs and sending diagnostic results to external DingTalk webhooks in `scripts/batch_diagnose.py`. While these behaviors are aligned with the stated purpose of a multi-agent stock analysis system, the use of shell commands for package management and outbound network calls to user-defined endpoints warrants a cautious classification under the provided security guidelines.