Today Earnings

从 Yahoo Finance 获取财报日历数据。适用于查询指定日期或当天财报、输出公司列表、按财报发布时间区分 BMO/AMC/TNS。当前实现基于 Chrome Extension + Native Messaging，需要本地安装 Chrome 扩展、Native Host、Google Chrome 与...

What to consider before installing: - This skill implements exactly what it claims: a Chrome extension + Native Messaging host + Node CLI to scrape Yahoo Finance. You must load the extension and run the provided install script (or run the generated Windows .bat) so Chrome can launch the native host. - Local-IPC exposure: when the host is started by Chrome it creates a UNIX domain socket at /tmp/today-earnings.sock that accepts requests from any local process. That means any local user or process could connect to the socket and cause the extension to open the Yahoo Finance earnings page and return scraped data. If you run multi-user systems or run untrusted local processes, treat this as a risk. Consider inspecting/adjusting the socket path and file permissions or running on an isolated account/machine. - Documentation vs. implementation mismatch: some docs say only AMC/BMO records will be kept, but the parser/transform code preserves AMC/BMO/TNS (and parser.js contains comments that differ from design.md). If you rely on strict filtering, review parser.js and scripts/get-company-list.mjs to confirm the actual behavior before using results programmatically. - Review produced files before running install.sh: install.sh writes manifest files and wrapper scripts and may prompt you to use sudo for system locations. Ensure the manifest's "path" is correct and points to trusted code (native-host/host.js or the generated run-host wrapper). On Windows, the generated install-windows.bat modifies HKCU (user registry) — review it before execution. - If you decide to install: run it on a single-user, trusted machine; verify /tmp/today-earnings.sock permissions after host start; consider removing the extension and native host artifacts when no longer needed (delete manifest files, wrapper scripts, and any generated Windows registry keys/manifest entries). - If you want higher assurance: ask the author to (1) restrict the socket to a less-global path and set restrictive file permissions, (2) add an authentication token exchanged by CLI and host, or (3) make the host accept connections only from a launched CLI process rather than any local process. If those changes are present, I would raise confidence to benign.

Type: OpenClaw Skill Name: today-earnings Version: 4.3.4 The skill bundle is a legitimate tool designed to scrape earnings data from Yahoo Finance using a Chrome Extension and Native Messaging architecture. While the installation script (native-host/install.sh) performs high-privilege actions such as writing to browser configuration directories and modifying the Windows registry, these are standard requirements for establishing a Native Messaging Host. The code logic across the background scripts, content scripts, and the Node.js bridge (host.js) is transparent, well-documented in design.md, and lacks any indicators of data exfiltration, unauthorized remote execution, or malicious prompt injection.