Stock Heat Rank

[Go语言版] 获取A股市场实时热度排名TOP50。聚合问财、雪球、东方财富三大平台人气榜单，计算复合热度分数。当用户需要查询A股热门股票、实时人气排名、市场关注度排行、涨停板热度分析时使用此技能。支持多平台热度对比，发现市场热点股票。

This skill appears to implement the stated feature (aggregating popularity lists and computing a composite heat score), but there are a few things to consider before installing: - Node.js/npm are required at runtime: the Go program execs 'node lib/hexin_v.js' and SKILL.md instructs running 'npm install' in lib. The registry metadata incorrectly claims no required binaries — make sure you have Node 18+ and npm available before running. - The bundled lib/hexin_v.js is large, minified/obfuscated, and is executed locally. The file is intended to generate a Hexin‑V request header for Wencai; if you are uncomfortable executing minified third‑party JS, review the file line-by-line or run the tool in an isolated environment (container or VM). You can also run network capture (tcpdump/Wireshark) during a test run to verify it only contacts the expected sites. - npm dependency 'canvas' may require native libraries (libcairo, etc.). Expect extra system-level dependencies when running 'npm install'. - The skill performs network requests to public platforms (iwencai, xueqiu, eastmoney). It does not request credentials, but scraping may be brittle and could trigger anti-bot protections. Avoid running as root; test in a sandbox and inspect network traffic if you need to be cautious about hidden endpoints. - If you want higher assurance: 1) Inspect lib/hexin_v.js (or replace it with a reviewed implementation), 2) run the Go binary with the Node call stubbed or instrumented to print the generated header without sending requests, 3) run in an isolated environment and verify behavior before using on a production machine. Given the metadata/instruction mismatch and the execution of bundled minified JS, treat this skill as suspicious until you confirm the JS signer does only local computation and there are no unexpected network calls.

Type: OpenClaw Skill Name: stock-heat-rank Version: 1.0.3 The skill bundle contains a heavily obfuscated JavaScript file (`lib/hexin_v.js`) which is required for generating API signatures. While the documentation claims this is extracted from official frontend code to bypass anti-scraping measures, the high level of obfuscation makes it impossible to verify if it contains hidden malicious logic. Furthermore, `main.go` uses `os/exec` to run this script via Node.js, which is a risky pattern. Although the behavior aligns with the stated purpose of scraping stock data, the presence of a large 'black box' execution payload is a significant security risk.