WSB 热股日报

自动抓取 r/wallstreetbets 热股数据，生成每日报告推送到 Discord。使用 ApeWisdom API，支持分片发送避免 Discord 2000 字符限制。

This skill is internally consistent with its stated purpose but do these checks before installing: 1) Edit TARGET_CHANNEL_ID and OPENCLAW_BIN to match your environment; verify the path to openclaw and that OpenClaw is already configured with Discord access (the skill calls the local openclaw CLI to send messages). 2) Prefer running the cron job as a non-root user and change example /root paths in the documentation to your home directory to avoid unnecessary use of root. 3) Review and be comfortable with outputs written to /tmp (raw and chunk files) and the log at /tmp/wsb-digest.log; these contain the generated digest. 4) The scripts assume Node.js v18+ is available on PATH; install Node or adjust PATH if needed. 5) The code is simple and fetches only apewisdom.io; nevertheless review any integration (OpenClaw) that holds Discord tokens/credentials before granting it send permissions. If you want extra assurance, run the scripts manually once (not via cron) and inspect the generated /tmp/wsb-latest.json and log to confirm behavior.

Type: OpenClaw Skill Name: wsb-digest Version: 1.0.0 The OpenClaw AgentSkills bundle 'wsb-digest' is classified as benign. Its primary function is to fetch stock data from ApeWisdom API and push a formatted report to Discord via the OpenClaw platform. All actions, including API calls to apewisdom.io and sending messages to Discord, align with its stated purpose. There is no evidence of intentional malicious behavior such as data exfiltration, unauthorized remote execution, or persistence mechanisms beyond the user-configured cron job. The `SKILL.md` file contains instructions for the user to set up the skill, not malicious prompt injections for the AI agent. While the `export HOME=/root` in `wsb-digest-trigger.sh` is unusual, it does not lead to any malicious behavior or vulnerabilities in this specific context as all file paths used are absolute. Potential vulnerabilities related to shell injection via `openclaw message send --message` if the upstream API provides malicious data are platform-level concerns, not indicative of malicious intent within this skill.