← Back to Skills Marketplace
99
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install shi-shi-cai-jing
Description
实时抓取并汇总新浪财经7×24小时全球财经新闻。通过API接口智能增量检测,每5分钟自动抓取最新新闻。
Usage Guidance
This skill mostly matches its description (periodically fetching and storing news via the Sina API), but there are three things you should consider before installing:
1) Unused/undeclared browser scraper: The repo includes fetch_and_save.js which uses puppeteer.connect to http://localhost:9222 and will read DOM from open browser pages (fallback to pages[0]). If you do not want any code reading your open browser tabs, do not run that script. Prefer using fetch_api.js (API-only) if you only need API pulls.
2) Missing dependency and install info: The metadata does not declare Node/npm or puppeteer requirements. If you plan to run the code, run it in a sandbox or container, and install dependencies explicitly (npm install puppeteer) after auditing them. Consider running only fetch_api.js (it uses only built-in https) to avoid installing puppeteer.
3) Unexpected characters and data: SKILL.md contains unicode control characters (prompt-injection signal) — view the file in a hex/clean text editor and remove suspicious invisible characters. The skill includes a large news_db.json sample; verify it contains only benign news before using or sharing it.
Recommended actions: inspect and optionally remove fetch_and_save.js if you don't need browser scraping; run fetch_api.js in a dedicated environment; review and sanitize SKILL.md for control characters; and only add the cron job for the script you trust. If you are uncertain, run the skill in an isolated VM/container and monitor network and filesystem activity.
Capability Analysis
Type: OpenClaw Skill
Name: shi-shi-cai-jing
Version: 1.0.0
The skill bundle is designed to fetch and aggregate real-time financial news from Sina Finance using both web scraping (via Puppeteer in fetch_and_save.js) and a public API (in fetch_api.js). It includes robust logic for incremental updates, data persistence in local JSON files, and automated cleanup of records older than seven days. No evidence of data exfiltration, malicious execution, or prompt injection was found; the code and instructions align perfectly with the stated purpose of tracking global financial news.
Capability Assessment
Purpose & Capability
The description promises API-driven incremental fetches every 5 minutes (and SKILL.md emphasizes using fetch_api.js, no browser required), but the repository also includes fetch_and_save.js which uses puppeteer and connects to a local browser debugging endpoint (http://localhost:9222). That file is not mentioned as a requirement (no required binaries, no declared dependency on puppeteer or a running Chrome/Chromium). The presence of a browser-based scraper is disproportionate to the stated 'API-only' purpose and is an undeclared capability.
Instruction Scope
SKILL.md instructs running node fetch_api.js and scheduling a cron, which is fine, but also the codebase contains fetch_and_save.js that will connect to a local browser and evaluate page DOM. That script falls back to pages[0] if it cannot find a finance page, meaning it may read content from arbitrary open tabs. The SKILL.md contains a detected 'unicode-control-chars' injection signal, which could be an attempt to manipulate prompt/evaluation flows. Overall the runtime instructions and included code allow reading broad local browser state not disclosed in the description.
Install Mechanism
There is no install spec; this is instruction-only, but the code requires Node and (implicitly) npm modules. fetch_api.js only uses built-in https, but fetch_and_save.js requires the puppeteer package and a running browser with remote debugging. Those dependencies are not declared or installed automatically, creating a mismatch and potential surprise for users. No remote downloads or odd URLs are present.
Credentials
The skill requests no environment variables or external credentials (which is appropriate). However, the puppeteer script requires access to a local browser debugging endpoint (localhost:9222) and will read page content from the browser; that is an implicit environment/resource access not declared in the metadata. No network exfiltration endpoints beyond the Sina API (https://app.cj.sina.com.cn) are present in the code.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and only writes data under its own workspace (data/news_db.json, state files). It suggests a cron job but does not force permanent installation or elevated privileges.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install shi-shi-cai-jing - After installation, invoke the skill by name or use
/shi-shi-cai-jing - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
初始版本
Metadata
Frequently Asked Questions
What is 实时财经?
实时抓取并汇总新浪财经7×24小时全球财经新闻。通过API接口智能增量检测,每5分钟自动抓取最新新闻。 It is an AI Agent Skill for Claude Code / OpenClaw, with 99 downloads so far.
How do I install 实时财经?
Run "/install shi-shi-cai-jing" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is 实时财经 free?
Yes, 实时财经 is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does 实时财经 support?
实时财经 is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created 实时财经?
It is built and maintained by ripplefox (@ripplefox); the current version is v1.0.0.
More Skills