← Back to Skills Marketplace
98
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install mysteel-marketanalysis
Description
大宗商品市场分析服务；当用户需要钢铁、有色、能源化工、炉料等品类的市场分析、行情跟踪或供需解读时使用
Usage Guidance
This skill is coherent with its stated purpose (calling Mysteel's analysis API and expanding the returned report), but take these precautions before installing: 1) Confirm you actually trust the endpoint https://mcp.mysteel.com and that you are allowed to send queries and confidential data to it. 2) Be aware the API key is stored in plaintext at references/api_key.md; consider storing secrets in a secure vault instead of a repo file. 3) The registry metadata omits that references/api_key.md is required—verify and update metadata or deployment procedures to avoid surprises. 4) Ensure the runtime has requests==2.31.0 installed or the script will fail. 5) If you do not have a Mysteel API key or don’t trust the source, do not provide a key; the skill enforces not answering without a valid key. If you want higher assurance, request the publisher to fix the metadata (declare the required config path), remove the plaintext key requirement, and document the exact API behavior and privacy guarantees.
Capability Analysis
Type: OpenClaw Skill
Name: mysteel-marketanalysis
Version: 1.0.0
The skill provides commodity market analysis by calling a remote API (mcp.mysteel.com). It uses the 'exec' tool to run a local Python script (scripts/analyze.py) which reads an API key from a local file (references/api_key.md). While the behavior aligns with the stated purpose, the instruction in SKILL.md to execute a shell command with user-controlled input ('--query "<query>"') presents a potential shell injection vulnerability. No evidence of intentional malice or data exfiltration was found.
Capability Assessment
Purpose & Capability
Name/description match the code and instructions: the skill queries a Mysteel analysis endpoint and returns/expands a Markdown report. However, the registry metadata claims no required config paths or env vars while the SKILL.md and scripts/analyze.py require a specific local file (references/api_key.md) containing the API key. This metadata omission is an inconsistency that should have been declared.
Instruction Scope
Runtime instructions are constrained: read a specific references/api_key.md file, construct a query, and run scripts/analyze.py which POSTs to https://mcp.mysteel.com. The skill does not instruct reading arbitrary system files or exfiltrating data to unexpected endpoints. It also enforces not answering without a valid API key.
Install Mechanism
There is no install spec (instruction-only) which reduces risk, but the SKILL.md declares a Python dependency (requests==2.31.0) while no installer is provided—if the runtime lacks that package the script will fail. No downloads or external installers are present.
Credentials
The skill requires a sensitive API key, but it expects the key in a plaintext file at references/api_key.md (not declared in registry metadata). The key is not requested via environment variables but stored/read from disk; storing secrets in a plaintext file is a confidentiality risk. The script error messages also reference an inconsistent identifier (MYSTEEL_CLAW_APIKEY), a minor red flag for sloppy documentation.
Persistence & Privilege
The skill does not request persistent/always-on privileges and does not modify other skills or system-wide settings. It only runs the provided script when invoked.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install mysteel-marketanalysis - After installation, invoke the skill by name or use
/mysteel-marketanalysis - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Mysteel_MarketAnalysis v1.0.0 – Initial Release
- Provides market analysis services for major commodities including steel, non-ferrous metals, energy, and raw materials.
- Requires configuration and strict verification of a Mysteel API key before any analysis or output.
- Supports structured analysis requests, triggering professional reports via an internal API and returning expanded, deeply interpreted Markdown reports.
- Robust error handling: strictly prohibits analysis if the API key is missing/invalid, with clear user prompts and guidance.
- Includes step-by-step guidance for setup, triggering, and exception handling to ensure reliable usage and compliance.
Metadata
Frequently Asked Questions
What is Mysteel_MarketAnalysis?
大宗商品市场分析服务；当用户需要钢铁、有色、能源化工、炉料等品类的市场分析、行情跟踪或供需解读时使用. It is an AI Agent Skill for Claude Code / OpenClaw, with 98 downloads so far.
How do I install Mysteel_MarketAnalysis?
Run "/install mysteel-marketanalysis" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Mysteel_MarketAnalysis free?
Yes, Mysteel_MarketAnalysis is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Mysteel_MarketAnalysis support?
Mysteel_MarketAnalysis is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Mysteel_MarketAnalysis?
It is built and maintained by mysteel (@wyb92); the current version is v1.0.0.
More Skills