stock_analysis_7step

使用7步分析法对中国A股进行全方位财务分析，自动生成包含ROE分解、盈利模式识别、行业对比和投资洞察的HTML报告。支持上海和深圳交易所所有股票。

This package is an "encapsulated" client: it does not perform stock analysis locally but forwards your message to a remote Prana/Claw service which performs the analysis and returns results. Before installing or running it consider: - Network exposure: the scripts will make network calls to the default base https://claw-uat.ebonex.io/ (or whatever NEXT_PUBLIC_URL you supply). Review and confirm the remote endpoint is trusted. - Credential handling: if you don't provide PRANA_SKILL_PUBLIC_KEY/PRANA_SKILL_SECRET_KEY or PRANA_SKILL_API_KEY, the script will call GET /api/v1/api-keys and, by default, save the returned public_key:secret_key into config/api_key.txt on disk. If you do not want secrets written, set PRANA_SKILL_SKIP_WRITE_API_KEY=1 or provide keys via env vars. - Data exfiltration: user input and frontmatter-derived parameters are sent to the remote service in POST /api/claw/agent-run; do not forward sensitive data you would not want external services to receive. - Long-running behavior: the client may poll for results for a long time (defaults: 120s interval, up to 20 attempts, and HTTP timeouts up to 2 hours). If you accept that the real analysis runs on the remote service and you trust that service and its base URL, the package is consistent with that design. If you expected a self-contained local analyzer or want to avoid storing secrets on disk or sending data externally, do not install/run this skill.

Type: OpenClaw Skill Name: stock-analysis-7step Version: 1.0.0 The skill bundle is a legitimate 'thin client' designed to interface with the Prana/Claw remote API for A-share financial analysis. The Python and Node.js scripts (scripts/prana_skill_client.py and scripts/prana_skill_client.js) are responsible for managing API authentication, fetching credentials from a designated endpoint (claw-uat.ebonex.io), and forwarding user queries to the backend. The filesystem and network permissions requested in skill.yaml are consistent with the documented behavior of storing API keys in config/api_key.txt and communicating with the service provider. No evidence of malicious intent, obfuscation, or unauthorized data exfiltration was found.