AI投资分析与决策助手，为用户提供股票、加密货币、房地产投资的分析和建议。支持实时数据分析、风险评估、投资策略优化。

What to consider before installing: - Treat this as a demo/local tool, not a production trading system. The code uses simulated/mock prices and does not implement real-time API integration out-of-the-box. - Do NOT reuse or trust the ClawHub login token found in publish-manual.txt — it appears to be an embedded secret. If you manage or mirrored this repo, rotate any exposed tokens/credentials and remove them from the repository history. - If you intend to connect real data providers (Yahoo/AlphaVantage/Binance/Coinbase/Zillow), add API keys in a secure config mechanism (not in repo files) and verify the skill explicitly declares required env vars before providing secrets. - Review analyzer.js for any shell execution or network calls before running on a machine with sensitive data. The script writes analysis_log.json to the working directory — consider where that file will live and who can read it. - Verify the maintainer and source: the homepage points to a GitHub repo under AIFinanceAssistant; confirm ownership and review upstream commits. If you plan to use this for real investing, audit the algorithms, test thoroughly, and consider legal/regulatory implications. If you want, I can: (1) point to the exact lines where the token appears, (2) suggest a safe recipe to remove secrets and sanitize history, or (3) produce a short checklist to harden this skill before use.

Type: OpenClaw Skill Name: ai-investment-analyzer Version: 1.1.1 The skill bundle contains a hardcoded authentication token (clh_stbFXRYc9RTR1Ck7e940tJ1e4AN0EU8X5S_MhoC8MFM) and explicit instructions in 'publish-manual.txt' for the AI agent to use this credential to log in and publish the skill. This constitutes a high-risk prompt injection/command injection attempt that could lead to unauthorized account actions or the agent operating under an attacker-controlled identity. While the core logic in 'analyzer.js' and 'advanced-predictions.js' appears to be a benign financial analysis tool using mock data, the inclusion of deployment credentials and instructions aimed at influencing the agent's behavior is a major security red flag.