← Back to Skills Marketplace
499
Downloads
0
Stars
0
Active Installs
15
Versions
Install in OpenClaw
/install stocktoday-skill
Description
Provides 200+ interfaces for A-share market data including stock basics, real-time quotes, financials, funds, futures, indexes, funds, bonds, macro, HK/US st...
Usage Guidance
Before installing or running this skill:
- Treat STOCKTODAY_TOKEN as sensitive: test with a non‑privileged or dummy token first. The code will POST the token to the primary host and to several hard-coded backup endpoints (including raw IPs).
- If you must use it, prefer configuring STOCKTODAY_URL to a trusted endpoint you control or trust; override or unset backup env vars (STOCKTODAY_BACKUP_URL1/2/3) if possible to prevent token being sent to unknown IPs.
- Inspect the shipped source (dist/index.js, src/index.ts, HTTP_CLIENT.py) yourself or in a sandboxed environment to confirm which hosts will receive requests and how errors/failover are handled.
- Run the MCP server in a network‑restricted sandbox (or with egress rules) if you want to limit which external hosts it can contact.
- Check the publisher/owner and prefer skills with a known homepage or repository; absence of homepage and an unknown owner ID reduces trust.
- If you need stronger assurance, ask the publisher for an explanation of the backup hosts and for documentation proving they are operated by the same trusted project, or request a build from a reproducible source.
Capability Analysis
Type: OpenClaw Skill
Name: stocktoday-skill
Version: 1.1.4
The skill bundle is a comprehensive MCP server providing access to over 200 A-share market data interfaces via a Tushare API mirror (tushare.citydata.club). The code (src/index.ts, HTTP_CLIENT.py) implements standard API client logic, including failover support for several hardcoded backup IP addresses (e.g., 111.229.164.2). While the use of unencrypted HTTP for backup servers is a minor security vulnerability for token transit, the bundle's behavior is entirely consistent with its stated purpose and lacks any evidence of malicious intent, data exfiltration beyond the intended API, or prompt injection.
Capability Assessment
Purpose & Capability
The skill's code and SKILL.md clearly implement an A‑share market data MCP server and require an API token and API URL; that matches the description. However the registry metadata declares no required environment variables or primary credential while the SKILL.md and the code expect STOCKTODAY_TOKEN (and optionally STOCKTODAY_URL and backup URL env vars). This metadata mismatch is an incoherence you should consider.
Instruction Scope
SKILL.md instructs only to set STOCKTODAY_TOKEN and optional STOCKTODAY_URL and shows example tool calls (which is within scope). The instructions do not mention the multiple hard‑coded backup endpoints present in the code, nor do they warn that your token will be POSTed to those backup servers if the main host fails.
Install Mechanism
There is no install spec (instruction-only at registry level), but the package includes full source (TypeScript/JS, Python client, package.json and lockfile). No remote download or extraction from unknown URLs occurs during install, and dependencies are normal npm packages. Presence of source files without an install script is not itself malicious but means code will run if you start the MCP server.
Credentials
Requesting an API token (STOCKTODAY_TOKEN) is proportionate to a market‑data client. The concern: the code will send that token to the primary host (tushare.citydata.club) and to three hard‑coded backup endpoints (two are raw IP addresses). Those fallback hosts are not documented in SKILL.md and receiving your token there would expose credentials to unknown operators.
Persistence & Privilege
The skill does not request always:true, does not declare system or other-skill config changes, and is user-invocable only. It can be invoked autonomously by an agent (default), but that is the platform norm and not flagged alone.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install stocktoday-skill - After installation, invoke the skill by name or use
/stocktoday-skill - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.1.4
- Updated documentation and metadata.
- Removed note about not needing the Tushare official token in SKILL.md.
- Minor cleanup and formatting improvements in documentation files.
v1.1.3
- Added new file: HTTP_CLIENT.py
- Updated core implementation files: src/index.ts, dist/index.js, and _meta.json
- No changes to user-facing documentation or features
- Internal improvements to code structure and HTTP client functionality
v1.1.2
v1.1.2: Add X-Client-Type header for request identification
v1.1.1
v1.1.1: Add trade_date to stk_factor_pro
v1.1.0
v1.1.0: 200+ APIs with backup server failover
v1.0.9
v1.0.9: latest only
v1.0.8
v1.0.8: Fix description
v1.0.7
v1.0.7: Add backup server failover support
v1.0.6
v1.0.6: 200+ APIs based on HTTP_CLIENT.py
v1.0.5
# StockToday Skill 1.0.5 Changelog
- Updated metadata and dependency information in _meta.json and package.json.
- No user-facing feature changes; documentation and configuration remain the same.
v1.0.4
- Renamed the project in documentation from "StockToday MCP" to "StockToday Skill".
- Updated the service description to emphasize "A 股市场数据接口".
- Minor language and style adjustments for clarity and consistency in SKILL.md.
- No functional or API changes, only documentation updates.
v1.0.3
- Updated dependency versions in package.json and package-lock.json.
- No changes to skill features or documentation content.
- Internal metadata (_meta.json) updated.
v1.0.2
- Expanded supported APIs from 155+ to 180+ (tool list now includes 181 tools).
- Added detailed tool listings by category for stocks, funds, futures, options, bonds, indices, and more.
- Updated and expanded feature descriptions (now including spot trading data).
- Added usage examples for common user queries.
- Section for environment variable configuration kept; parameter calling method simplified.
- General documentation layout improved for clarity and tool discovery.
v1.0.1
StockToday MCP v1.0.1
- Improved project structure: added meta information and removed unused generated files.
- Updated main code and test scripts for stability and maintenance.
- No changes to user-facing API or documentation.
v1.0.0
Initial release of StockToday MCP – comprehensive stock data server.
- Provides access to 155+ Tushare API endpoints.
- Supports stock basics, real-time quotes, financial reports, funds flow, indices, funds/futures/options, and special datasets.
- Easy token-based authentication via environment variable or API parameter.
- No official Tushare token required; powered by a custom backend service.
Metadata
Frequently Asked Questions
What is Stocktoday Skill?
Provides 200+ interfaces for A-share market data including stock basics, real-time quotes, financials, funds, futures, indexes, funds, bonds, macro, HK/US st... It is an AI Agent Skill for Claude Code / OpenClaw, with 499 downloads so far.
How do I install Stocktoday Skill?
Run "/install stocktoday-skill" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Stocktoday Skill free?
Yes, Stocktoday Skill is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Stocktoday Skill support?
Stocktoday Skill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Stocktoday Skill?
It is built and maintained by wglink (@usa2046); the current version is v1.1.4.
More Skills