← Back to Skills Marketplace
149
Downloads
0
Stars
1
Active Installs
3
Versions
Install in OpenClaw
/install my-stock-longbridge-skill
Description
长桥证券(Longbridge)OpenAPI 集成与交易管理技能
Usage Guidance
This skill appears to implement legitimate Longbridge trading functions, but it hardcodes API credentials and assumes write/CLI access that it does not declare. Do NOT install or run it on any account containing real money or private data until the author fixes these issues. Minimum actions to make this safe: remove hardcoded APP_KEY/APP_SECRET/ACCESS_TOKEN from all files and require the use of secure secrets (environment variables or the platform's secret store); update SKILL.md to describe exact config paths and permissions; avoid writing to /home/admin (use a relative or declared path); verify the openclaw message target and bot account are intentional; rotate any credentials that were embedded (treat them as compromised). If you need help vetting a cleaned version, request the updated package or ask the author for an explanation and proof that embedded credentials have been revoked.
Capability Assessment
Purpose & Capability
Functionality (submit/cancel orders, streaming notifications, account/market queries) matches the Longbridge trading purpose. However the bundle claims to rely on configured secrets but instead hardcodes APP_KEY/APP_SECRET/ACCESS_TOKEN in multiple files and includes an embedded bot account/target for notifications; those specifics are not justified or declared in the metadata.
Instruction Scope
SKILL.md tells the user to configure credentials via 'openclaw secrets configure', but the runtime code ignores that and uses hardcoded credentials. The code reads/writes a HISTORY_FILE under /home/admin/.openclaw/skills/... and invokes the 'openclaw' CLI via subprocess to send messages to a target user — these filesystem and CLI operations are not declared in the skill instructions or registry metadata.
Install Mechanism
There is no install spec (instruction-only), but the package includes a requirements.txt (longbridge, tenacity) and multiple Python modules. No remote downloads or installers are present, which lowers install-time risk, but the lack of an install/install-time guidance (virtualenv, where to place files) combined with embedded secrets is problematic.
Credentials
The code hardcodes APP_KEY, APP_SECRET, and a long ACCESS_TOKEN in multiple files instead of using declared environment variables or secret storage. The skill declares no required env vars or config paths, yet it expects write access to /home/admin/.openclaw/skills/... and access to the 'openclaw' CLI and a bot account/target. Hardcoded credentials and undeclared access are disproportionate and dangerous for a public skill.
Persistence & Privilege
The skill does not set always:true and does not modify other skills' configs, but it runs a long-lived notifier (daemon) that subscribes to private topics and calls out to an external messaging command. This gives it continuous network/IO presence while active; combined with hardcoded credentials, that increases blast radius but is not itself a declared privilege escalation.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install my-stock-longbridge-skill - After installation, invoke the skill by name or use
/my-stock-longbridge-skill - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.2
修复SKILL.md缺少YAML frontmatter问题
v1.0.1
批量同步最新版本
v1.0.0
Initial release: stock trade management for Longbridge
Metadata
Frequently Asked Questions
What is my_stock_longbridge_skill?
长桥证券(Longbridge)OpenAPI 集成与交易管理技能. It is an AI Agent Skill for Claude Code / OpenClaw, with 149 downloads so far.
How do I install my_stock_longbridge_skill?
Run "/install my-stock-longbridge-skill" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is my_stock_longbridge_skill free?
Yes, my_stock_longbridge_skill is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does my_stock_longbridge_skill support?
my_stock_longbridge_skill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created my_stock_longbridge_skill?
It is built and maintained by canonxu (@canonxu); the current version is v1.0.2.
More Skills