← 返回 Skills 市场

A-Share Multi-Dimensional Quantitative Analysis

Name: A-Share Multi-Dimensional Quantitative Analysis
Author: li-evan

作者 Evan · GitHub ↗ · v1.4.0 · MIT-0

cross-platform ⚠ suspicious

486

总下载

当前安装

版本数

在 OpenClaw 中安装

/install a-share-multidim-quant-analysis

功能描述

A-Share Multi-Dimensional Quantitative Analysis MCP Server - broker research reports, AI news analysis, and stock comprehensive analysis

使用说明 (SKILL.md)

A-Share Multi-Dimensional Quantitative Analysis

Hosted MCP server providing A-share (China stock market) multi-dimensional quantitative analysis for AI agents. Includes broker research reports, AI news sentiment analysis, and comprehensive stock analysis. Connect directly — no deployment needed.

Tools

`search_research_reports`

Search broker research reports by company name. Returns full-text reports including title, source, content, and date.

Input: company_name (e.g. "比亚迪"), limit (default 10)
Coverage: 5,000+ research reports, continuously updated

`search_news_analysis`

Search AI-analyzed news by company name and date range. Returns original news, AI summary, sentiment analysis, investment recommendations, and importance score.

Input: company_name, start_date (optional), end_date (optional), limit (default 10)
Coverage: 19,000+ analyzed news items covering individual stocks and industries

`get_stock_analysis`

Get the latest comprehensive analysis for a stock by its code. Returns technical analysis, fundamental analysis, news sentiment, investment debate, risk management, and final trading decision.

Input: stock_code (e.g. "601900", "000001", "300750")
Coverage: 3,000+ stocks, 12,000+ analysis reports

Setup

Add to your .mcp.json:

{
  "mcpServers": {
    "yanpan": {
      "type": "http",
      "url": "http://42.121.167.42:9800/mcp",
      "headers": {
        "Authorization": "Bearer \x3CYOUR_API_KEY>"
      }
    }
  }
}

That's it. No installation, no Docker, no database — just connect and use.

Get API Key

To get your own API key, contact via WeChat: ptcg12345

安全使用建议

This skill appears to do what it claims (provide research/news/stock analysis) but includes worrying artifacts: plaintext default API token and MongoDB credentials and hard-coded IPs in server.py that are not documented in SKILL.md. Before installing or running anything from this skill: - Do not run the included server.py locally unless you trust the source. The file will attempt to connect to a remote MongoDB using embedded credentials. - Ask the publisher for provenance: who operates the servers at 42.121.167.42 and 121.43.242.239, and why are DB credentials embedded in the code? Request a privacy/security policy and an official API endpoint and docs. - Prefer using your own hosted instance or a vetted provider. If you must use the remote service, require an API key over HTTPS (SKILL.md uses http) and confirm TLS and authentication are enforced. - Treat the provided default credentials as compromised; insist they be removed from source and rotated. If the publisher cannot satisfactorily explain the hard-coded credentials and endpoints, avoid using this skill or running its server.

功能分析

Type: OpenClaw Skill Name: a-share-multidim-quant-analysis Version: 1.4.0 The skill bundle contains hardcoded administrative credentials ('admin' / 'tradingagents123') for a remote MongoDB instance (121.43.242.239) within `server.py`. It also exhibits NoSQL injection vulnerabilities by passing unsanitized user input directly into MongoDB `$regex` queries in the `search_research_reports` and `search_news_analysis` tools. Furthermore, `SKILL.md` instructs users to connect to a remote, unencrypted HTTP MCP server (42.121.167.42), which is a high-risk configuration for transmitting API tokens.

能力评估

ℹ Purpose & Capability

Declared tools (research report search, news analysis search, stock analysis) map directly to the functions implemented in server.py; the overall capability matches the name/description.

⚠ Instruction Scope

SKILL.md instructs agents to connect to an external MCP server (http://42.121.167.42:9800/mcp) using a bearer token and gives an out-of-band WeChat contact for an API key — that is consistent with using a hosted service. However the shipped server.py would itself connect to a different hard-coded MongoDB host/IP and uses environment variables with insecure defaults. The SKILL.md does not disclose these backend endpoints, credentials, or the fact that the service will fetch full-text reports from a remote DB.

✓ Install Mechanism

No install spec; the skill is instruction-only (no automatic downloads). The package includes server.py and pyproject metadata but provides no install hooks — low installation surface.

⚠ Credentials

Registry metadata listed no required env vars, but server.py reads env vars and ships hard-coded sensitive defaults: API_TOKEN default 'yanpan-mcp-secret-2026', MongoDB host 121.43.242.239, username 'admin' and password 'tradingagents123'. Those credentials and remote IPs are unexpected and disproportionate (plaintext DB creds baked into the code).

✓ Persistence & Privilege

always is false and the skill does not request system-wide privileges or modify other skills. If the included server were executed, it would run a network service, but nothing in the package forces persistent installation on the user's system.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install a-share-multidim-quant-analysis
安装完成后，直接呼叫该 Skill 的名称或使用 /a-share-multidim-quant-analysis 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.4.0

Update WeChat contact to ptcg12345

v1.3.0

New slug; replace API token with placeholder; add WeChat contact for API key

元数据

Slug a-share-multidim-quant-analysis

版本 1.4.0

许可证 MIT-0

累计安装 5

当前安装数 4

历史版本数 2

常见问题