A-Share millisecond-level market data watcher using Tencent direct API.

What to check before installing/running: 1) Confirm the author/source — repository metadata and homepage are missing. 2) Ask the publisher to explain how SKILL.md actions (get_market_snapshot, check_volatility) map to the included scripts; the mismatch could be sloppy packaging. 3) Run code in an isolated environment (container/VM) because daemon.py runs an infinite loop and calls os.system to execute osascript (macOS). 4) If you will use the notification feature, review/adjust notify_mac to avoid shell invocation or better escape single quotes (current code only replaces double quotes). 5) Install and audit required Python packages (requests, akshare, pandas); requirements.txt is empty so dependencies are undeclared. 6) If you need cross‑platform behavior, note the macOS-only notifier and either disable it or add an OS check. If you cannot verify the author or fix the above inconsistencies, treat the skill as untrusted and avoid running it on production systems or systems with sensitive data.

Type: OpenClaw Skill Name: ashare-fast-watcher Version: 1.0.1 The skill bundle contains a command injection vulnerability in daemon.py within the notify_mac function. It uses os.system to execute osascript for macOS notifications using market data fetched from the Tencent API (qt.gtimg.cn) without sanitizing single quotes, which could allow arbitrary code execution if the API response is compromised. While the overall logic in index.py and radar.py aligns with the stated purpose of A-Share market monitoring and uses legitimate libraries like akshare, the insecure implementation of system-level notifications is a high-risk flaw.