Stock Monitor Skill 0.1.0

全功能智能股票监控预警系统。支持成本百分比、均线金叉死叉、RSI超买超卖、成交量异动、跳空缺口、动态止盈等7大预警规则。符合中国投资者习惯（红涨绿跌）。

This skill appears to be a legitimate stock-monitoring daemon that fetches public market/news data and sends alerts. Before installing or running it: 1) Inspect the code and confirm you’re comfortable running a background process that writes to $HOME/.stock_monitor and creates a PID file. 2) Note README/SKILL.md mention config.example.py and a RULE_REVIEW_REPORT.md that are not present — create or review a config file (and remove any hardcoded personal paths) before starting. 3) Search the code for any notification/send functions to see where alerts would be delivered (no notifier endpoint is clearly configured). 4) Run the test suite and code in an isolated environment or container first (the test suite contains an absolute path to /home/wesley that you should remove). 5) If you need network isolation, audit which external domains (eastmoney, sina, push2.eastmoney, etc.) the scripts contact and consider firewall or proxy rules. If you want, I can point to the exact lines that reference missing files, the hardcoded path in tests, and the notification placeholder so you can edit them prior to running.

Type: OpenClaw Skill Name: stock-monitor-skill-0-1-0 Version: 1.0.0 The OpenClaw AgentSkills skill bundle 'stock-monitor-skill-0-1-0' is classified as benign. All code and documentation align with the stated purpose of a stock monitoring and alerting system. The `SKILL.md` provides clear instructions for the agent to manage the skill's daemon via `control.sh`, which is expected behavior for an OpenClaw skill and does not contain prompt injection attempts to subvert the agent. Python scripts (`analyser.py`, `monitor.py`, `monitor_daemon.py`) make legitimate network requests to well-known financial data providers (Eastmoney, Sina) to fetch public stock data, without any evidence of data exfiltration, malicious execution, persistence mechanisms beyond the stated daemon, or obfuscation. The `test_suite.py` contains a hardcoded path, which is a minor code quality issue for a test script but not a security vulnerability or indicator of malice.