Stock Entry Analyzer

多指标股票入场分析工具。基于乖离率 (BIAS) 为核心，结合均线/MACD/RSI/成交量/资金流/估值等 7 大类指标，综合判断股票或基金是否适合买入。使用 stock-price-query、stock-market-pro、eastmoney-tools 获取数据，输出检查清单和综合评分。当用户询问"XX...

This skill implements the advertised stock-analysis logic, but it reads an EastMoney API key (EM_API_KEY) and directly accesses a vault file (/root/.openclaw/workspace/vault/credentials/eastmoney.json) while the registry metadata declares no required secrets. Before installing: 1) ask the publisher to declare EM_API_KEY (or other credentials) in the skill metadata and explain why vault access is needed; 2) review or sandbox the skill — it executes other skills' scripts from /root/.openclaw/workspace which could run arbitrary code, so verify those scripts (stock-price-query, mx-finance-data) are trustworthy; 3) ensure required Python packages (pandas, openpyxl) are available or explicitly listed; 4) if you keep secrets in a shared vault, consider restricting this skill's access or running it in an isolated environment; 5) if you can't verify the other skills or the vault contents, do not grant this skill access to your production agent.

Type: OpenClaw Skill Name: stock-entry-analyzer Version: 3.0.0 The skill bundle implements a stock analysis tool that exhibits high-risk behaviors, specifically direct access to sensitive credential files in the OpenClaw vault (/root/.openclaw/workspace/vault/credentials/eastmoney.json) and the execution of external scripts via subprocess.run (found in analyze_stocks.py and analyze_stocks_v2.py). While these actions are plausibly aligned with the stated purpose of integrating multiple financial data sources (e.g., Eastmoney and Tencent), the practice of hardcoding paths to other skills and directly reading shared credentials represents a significant security risk within the agent environment. No clear evidence of intentional malice or data exfiltration was identified.