Sends a daily 15:10 summary of A-share closing data including index changes, volume, hot sectors, and main capital flow via Feishu.

This skill appears to do what it says (fetch EastMoney data and send a closing report via Feishu), but there are two things to consider before installing: - Command injection risk: the script builds a shell command with execSync and interpolates the whole report into it. Although it escapes quotes/newlines, other shell metacharacters from the fetched data could allow command execution. Prefer a safer send mechanism (use an API/client library or execFile with args) or robustly escape all shell metacharacters. - Hardcoded recipient: the script contains a fixed Feishu user id. Confirm this id is intended; otherwise modify the script to accept a configured recipient (via a declared setting or env var) to avoid sending reports to the wrong person. Other practical checks: ensure the openclaw CLI will be available in the runtime environment, and consider running the skill in a constrained environment (limited privileges) until you review and, if needed, patch the script to remove shell execution and make the recipient configurable.

Type: OpenClaw Skill Name: a-stock-evening Version: 1.0.0 The skill contains a shell injection vulnerability in `scripts/closing-summary.mjs` where data fetched from external APIs (Eastmoney) is passed to `execSync` with insufficient sanitization (only double quotes and newlines are escaped, leaving shell metacharacters like backticks or dollar signs vulnerable). Additionally, the script hardcodes a specific Feishu user ID (`ou_d70ce91dc6fdd7aa7ceacb1c312618a0`), which causes the report to be sent to a fixed recipient rather than the user executing the skill, deviating from the behavior described in `SKILL.md`.