Panda Data Skill

PandaAI 金融数据 API 的 LLM Tool 封装多个数据查询方法，支持A股行情、A股基本面，期货，指数等

This skill looks like a legitimate PandaAI data wrapper, but there are documentation/metadata mismatches you should resolve before installing. Specifically: SKILL.md and INSTALL_GUIDE require PANDA_DATA_USERNAME and PANDA_DATA_PASSWORD (sensitive credentials) and pip installation of panda_data / panda-data-tools, yet the registry metadata lists no required env vars. Before you proceed: 1) Confirm with the publisher (or PyPI project page) that the required env vars are correct and whether an API key/token alternative exists (prefer tokens over account passwords). 2) Inspect the panda_data and panda-data-tools PyPI packages and source repositories (verify maintainers, recent releases, and code) before running pip install. 3) If you must use credentials, create a least-privilege account (or limited/test account) and avoid sharing credentials in public chats. 4) Run the package in an isolated environment (virtualenv/container) and check network activity if you need higher assurance. 5) Ask the skill owner to update registry metadata to declare the required env vars (so the platform can surface the need for credentials). If you cannot verify the external packages or the publisher, treat this skill as higher risk and avoid supplying real credentials.

Type: OpenClaw Skill Name: panda-data-skill Version: 3.0.0 The panda-data-skill bundle is a legitimate wrapper for the PandaAI financial data API, providing 61 tools for querying A-share market data, financial reports, and futures. The bundle includes a helper script (scripts/call_tool.py) for the agent to execute API calls and comprehensive documentation (SKILL.md, api_reference.md) for tool usage. It requires standard authentication via environment variables (PANDA_DATA_USERNAME/PASSWORD) and relies on external PyPI packages (panda_data and panda-data-tools). No evidence of data exfiltration, malicious execution, or prompt injection was found.