Alpha Vantage 金融数据 API。支持股票、外汇、加密货币的实时和历史数据。 免费 API key: demo (限流)，建议申请自己的免费 key。

This skill appears to do what it claims: it calls alphavantage.co and stores a provided API key in a local config.json. Before installing, consider: (1) the package author/source is unknown and there is no homepage — review the code if you don't trust the origin; (2) the API key is saved in plaintext to config.json in the skill directory—ensure that directory's permissions are acceptable or avoid storing sensitive/prod keys there; (3) SKILL.md mentions an ALPHA_KEY env var and shorter command names that the script doesn't actually use—follow the script's documented usage (node alpha.js ...) or inspect/adjust the code if you want env-var support; (4) prefer creating a dedicated Alpha Vantage key with limited permissions/usage and monitor usage for unexpected requests.

Type: OpenClaw Skill Name: alpha-vantage-api Version: 1.0.0 The skill is designed to interact with the Alpha Vantage financial data API. The `alpha.js` script uses `https` to communicate with the legitimate Alpha Vantage endpoint and manages its API key by storing it in a local `config.json` file. While storing an API key in plain text is a security vulnerability, the script does not attempt to exfiltrate this key or any other sensitive data to unauthorized destinations, nor does it access unrelated sensitive files or environment variables. The `SKILL.md` instructions are clear, align with the stated purpose, and do not contain any prompt injection attempts or instructions for malicious behavior. No evidence of intentional harmful behavior, unauthorized execution, or persistence mechanisms was found.