获取并生成 A股单只股票的关键指标“体检卡”（估值/盈利质量/现金流/负债/分红/交易活跃度等），输出为统一 Markdown，便于对比与持续跟踪。用在："帮我查600406关键指标"、"做一张国电南瑞体检卡"。

This skill appears coherent and focused: it fetches public market and financial data and writes a Markdown 'metrics card' locally. Before installing/using it, consider: (1) install required Python packages (akshare, curl_cffi) in a virtual environment; the skill has no automatic installer. (2) It performs network requests (Eastmoney push2 and AkShare upstream APIs) — expect rate limits, possible blocking on cloud hosts, and check source data licensing/terms. (3) It writes files to notes/stocks/cards by default — verify that path is acceptable. (4) If you run automated agents, remember this skill can be invoked by the agent (normal behavior); review the script yourself or run it in an isolated environment if you have security concerns.

Type: OpenClaw Skill Name: a-share-metrics-card Version: 1.0.0 The skill's stated purpose of generating A-share metrics cards is benign. However, the `scripts/metrics_card.py` script directly uses the `args.out` parameter to construct the output file path without sanitization. This creates a path traversal vulnerability, allowing an attacker who can control the `outputPath` argument (e.g., via prompt injection against the agent) to write files to arbitrary locations on the filesystem. While not explicitly malicious code, this vulnerability makes the skill suspicious.