Daily emails listing recent A-share IPOs and selected stocks priced under 20 yuan, including key trading details.

This package performs more privileged and sensitive actions than the registry metadata claims. Before installing or running it: 1) Inspect and remove any hard-coded credentials (test-smtp.js) and never run with those credentials; create a dedicated SMTP account/authorization for this skill. 2) Do not blindly run fix-hosts.sh or any script that uses sudo — examine the exact hosts entries and only apply them if you trust the source and understand the change. 3) Prefer exporting SMTP_CONFIG at runtime rather than adding it to ~/.zshrc/rc files; keep secrets out of checked-in files. 4) Run npm install only after reviewing package.json and package-lock.json; verify dependencies come from a trusted registry. 5) If you want to test, run the code in an isolated environment (container or VM) and avoid adding cron jobs until you confirm behaviour. The inconsistencies (metadata vs code) and embedded plaintext password are red flags — treat this as potentially unsafe until you remediate those issues.

Type: OpenClaw Skill Name: astock-daily Version: 1.0.0 The skill is classified as suspicious due to several high-risk capabilities, despite their stated purpose. It prompts for and stores SMTP credentials (email and password/auth code) in plain text in `.env` files and potentially shell configuration files (`.zshrc`, `.bashrc`). The `fix-hosts.sh` script performs privileged operations by modifying `/etc/hosts` using `sudo`. The `index.js` and `send-mail-applescript.js` files use `child_process.exec` to run system commands (`sendmail`, `osascript`), which could be vulnerable to injection if the content were not carefully controlled. Additionally, the `nodemailer` configuration in `index.js` and `test-smtp.js` uses `tls: { rejectUnauthorized: false }`, which disables certificate validation and makes the SMTP connection vulnerable to Man-in-the-Middle attacks. While these actions are explained as necessary for the skill's functionality (sending daily stock updates via email and fixing specific network issues), they represent significant security vulnerabilities and poor security practices, elevating the classification to suspicious rather than benign. There is no clear evidence of intentional malicious behavior like data exfiltration to unauthorized parties or unauthorized remote control.