Stock Monitor

股票价格实时监控。支持多只股票监控，使用 Yahoo Finance API 获取实时股价，自定义涨跌阈值提醒。当股价波动超过设定阈值时自动发送提醒，支持首次预警和续警机制。用于：(1) 监控持仓股票价格波动 (2) 设置价格提醒 (3) 定期检查股价变化

Review before installing, especially if you expected only Yahoo Finance price alerts. Install only if you are comfortable with scheduled background checks, local portfolio-related state files, Yahoo Finance requests, and the included but under-documented Futu/OpenD script. Do not place brokerage or Futu unlock passwords in the config unless the publisher clearly documents why they are needed, how they are protected, and how to disable or remove that mode.

Type: OpenClaw Skill Name: stock-monitor Version: 1.3.0 The skill is classified as suspicious due to a potential prompt injection vulnerability identified in the `SKILL.md` file. The `openclaw cron add` command includes a `--message` argument that instructs the AI agent to "运行 python3 ~/.openclaw/workspace/skills/stock-monitor/scripts/stocks_monitor.py 并把输出发给我" (Run python3 ... and send me the output). While the specific command executed here is benign (running the skill's own script), this pattern demonstrates a vulnerability where an attacker could potentially inject arbitrary commands into the agent's execution flow via the `--message` parameter. The Python scripts themselves (e.g., `scripts/stocks_monitor.py`, `scripts/futu_stocks_monitor.py`) appear benign, performing legitimate stock monitoring functions, accessing expected local configuration/state files, and interacting with known financial APIs (Yahoo Finance, local Futu OpenD) without evidence of malicious intent like data exfiltration or unauthorized access.