Stock Price Query MX

实时股票行情查询，支持 A 股、港股、美股及大盘指数，支持批量查询。无需 API Key。Real-time stock & index quotes for A-shares, HK & US markets. Batch supported.

This skill appears to implement real-time stock queries, but there are inconsistencies and risky behaviors you should consider before installing: - The README claims 'no API Key', yet the Python code tries to use EM_API_KEY (from env) or reads /root/.openclaw/workspace/vault/credentials/eastmoney.json. That means it may attempt to access platform-stored credentials without declaring it. Do not install unless you accept that behavior. - The script invokes another skill's script at /root/.openclaw/workspace/skills/mx-finance-data/scripts/get_data.py and then reads Excel files that the other script outputs. That cross-skill access can read or process files outside this skill and could be used to access sensitive workspace data. Ask the author why this cross-skill call is necessary and request that the required functionality be included in this skill or replaced by direct, documented API calls. - The skill uses pandas and reads Excel files but lists only python3 as a required binary. Verify that the runtime environment has needed Python packages, or that a safe install plan is provided. - If you must use it: run the skill in a restricted/sandboxed agent environment that prevents access to /root/.openclaw/workspace and the vault, or inspect the external get_data.py file and the eastmoney.json vault contents first. Prefer versions that use only public HTTP APIs (qt.gtimg.cn) without accessing platform vaults or other skills. What would change this assessment: if the publisher provides an explanation showing the mx-finance-data get_data.py is bundled and audited as part of this skill (not an unaudited external script), if the skill is updated to stop reading platform vault paths and instead documents required API keys explicitly, or if the code is modified to only use public APIs and to declare required dependencies (pandas) clearly.

Type: OpenClaw Skill Name: stock-price-query-mx Version: 1.1.4 The skill is classified as suspicious due to its practice of accessing sensitive credential files from a hardcoded path (`/root/.openclaw/workspace/vault/credentials/eastmoney.json`) and executing scripts from an external skill directory (`mx-finance-data`) using `subprocess.run`. While `scripts/stock_query.py` implements regex-based input validation to prevent simple shell injection, the hardcoded reliance on specific filesystem structures and cross-skill execution increases the attack surface and potential for unauthorized data access within the OpenClaw environment. The script also interacts with the external domain `qt.gtimg.cn` for data retrieval.