eastmoney skills

东方财富妙想提供的金融技能集合，涵盖金融数据查询、资讯搜索、智能选股、自选股管理和模拟组合管理，所有技能均需通过MX_APIKEY进行认证。

This skill is plausible (financial API usage with an API key) but several red flags mean you should be cautious: 1) The registry metadata does NOT list the MX_APIKEY or Node requirement even though SKILL.md requires them — ask the publisher to correct the manifest. 2) The installation instructs downloading and extracting multiple zip files from an external host (marketdfs.dfcfw.com) with no integrity checks — verify the URLs and obtain signed releases or inspect archives in a sandbox before running. 3) The provided install script contains syntax errors and uses rm -rf on a pattern; do not run it as-is or as root. 4) Prefer to manually inspect downloaded SKILL.md/SKILL files and run installations in an isolated environment (VM/container) and only provide your MX_APIKEY after confirming the publisher and URLs. If you cannot verify the source or get corrected metadata, treat this as untrusted and avoid installing.

Type: OpenClaw Skill Name: mx-skills Version: 1.0.2 The skill bundle acts as a meta-installer that instructs the agent to execute shell commands (curl, unzip, rm) to download and extract multiple remote ZIP archives from marketdfs.dfcfw.com into the ~/.openclaw directory. While these actions are aligned with the stated purpose of installing financial tools, the pattern of fetching and executing remote content via agent instructions represents a significant supply chain risk and potential RCE vector if the source is compromised, warranting a suspicious classification despite the lack of explicit malicious intent.