Stock Monitor

股票价格实时监控。支持多只股票监控，使用 Yahoo Finance API 获取实时股价，自定义涨跌阈值提醒。当股价波动超过设定阈值时自动发送提醒，支持首次预警和续警机制。用于：(1) 监控持仓股票价格波动 (2) 设置价格提醒 (3) 定期检查股价变化

Review the bundled scripts before installing. Use the Yahoo monitor only if you are comfortable with periodic stock lookups and local state files. Do not place Futu unlock credentials in the config unless you understand exactly what that unlock enables and why this skill needs it. Treat the rebalance script as an additional financial reminder workflow that is not described in the main skill documentation.

Type: OpenClaw Skill Name: stock-monitor Version: 1.3.0 The skill is classified as suspicious due to a potential prompt injection vulnerability identified in the `SKILL.md` file. The `openclaw cron add` command includes a `--message` argument that instructs the AI agent to "运行 python3 ~/.openclaw/workspace/skills/stock-monitor/scripts/stocks_monitor.py 并把输出发给我" (Run python3 ... and send me the output). While the specific command executed here is benign (running the skill's own script), this pattern demonstrates a vulnerability where an attacker could potentially inject arbitrary commands into the agent's execution flow via the `--message` parameter. The Python scripts themselves (e.g., `scripts/stocks_monitor.py`, `scripts/futu_stocks_monitor.py`) appear benign, performing legitimate stock monitoring functions, accessing expected local configuration/state files, and interacting with known financial APIs (Yahoo Finance, local Futu OpenD) without evidence of malicious intent like data exfiltration or unauthorized access.