← 返回 Skills 市场

银行外汇牌价

Name: 银行外汇牌价
Author: lhmcn

作者 lhmcn · GitHub ↗ · v0.1.3 · MIT-0

cross-platform ⚠ suspicious

314

总下载

当前安装

版本数

在 OpenClaw 中安装

/install chinese-bank-forex-rates

功能描述

Use when you need the latest bank forex rates from major Chinese banks by bank name and currency names. Supports 招商银行, 中国银行, 中国农业银行, 中国工商银行, 中国建设银行, and 交通银行...

使用说明 (SKILL.md)

\r \r

Chinese Bank Forex Rates\r

\r Use this skill when you need the latest forex rates for a supported Chinese bank and one or more currencies.\r \r

Inputs\r

bank: bank name or alias\r
currencies: one or more currency names or ISO codes\r \r

Output\r

\r The script returns JSON with:\r \r

bankName\r
updateTime in ISO 8601 format when normalization is possible\r
rates: list of objects with currencyName, buyPrice, and sellPrice\r \r Prices are standardized to CNY per 100 units of foreign currency, rounded to two decimal places. If the preferred value and configured fallback are both empty, the field is returned as an empty string.\r \r

Supported Banks\r

招商银行\r
中国银行\r
中国农业银行\r
中国工商银行\r
中国建设银行\r
交通银行\r \r

Price Selection Rule\r

\r When a bank exposes explicit 现汇 and 现钞 columns, the implementation uses:\r \r

buyPrice: prefer 现汇买入价, then 现钞买入价\r
sellPrice: prefer 现汇卖出价, then 现钞卖出价\r \r If a bank only publishes one buy and one sell price, the published pair is used directly.\r \r

Invocation\r

\r From this skill directory:\r \r

node index.js --bank 中国银行 --currencies 美元,EUR\r

安全使用建议

This skill appears to be what it says (a scraper for Chinese bank forex rates), but two warning signs require caution: (1) the SKILL.md contains scanner-detected hidden/obfuscated content (base64 and unicode-control characters) which could hide instructions or prompt-injection, and (2) the shipped index.js is a large pre-bundled script that will execute locally. Before installing or running: inspect the raw SKILL.md for hidden/encoded blocks and decode them; open or lint index.js (or run it in an isolated sandbox) to confirm it only fetches bank pages and parses rates; do not provide any credentials; run initial tests with network access restricted or monitored. If you are not comfortable inspecting code, prefer a skill from a verified/published source or ask the author for a minimal, auditable implementation.

功能分析

Type: OpenClaw Skill Name: chinese-bank-forex-rates Version: 0.1.3 The provided files (SKILL.md, package.json, and _meta.json) describe a utility for fetching currency exchange rates from major Chinese banks. The documentation is consistent with the stated purpose, and there are no signs of malicious instructions, prompt injection, or suspicious data handling in the metadata or instructions.

能力评估

✓ Purpose & Capability

Name, description, SKILL.md instructions, package.json, and the included index.js all align with a web-scraping/HTML-parsing tool for bank forex rates. The presence of css-select / domutils-like code in the bundle is consistent with parsing bank pages.

⚠ Instruction Scope

Visible SKILL.md instructions are narrowly scoped (invoke node index.js with bank and currencies). However the pre-scan flagged 'base64-block' and 'unicode-control-chars' in SKILL.md — these indicate hidden/obfuscated content in the skill instructions that could attempt to manipulate the model or hide behavior. The SKILL.md as shown does not request unrelated files or env vars, but the hidden patterns are concerning and should be examined.

ℹ Install Mechanism

There is no install spec (no downloads), which is lower risk. However a 2.5 MB bundled index.js is included and will execute locally when invoked; it contains many third-party libraries for HTML parsing. That is reasonable for a scraper, but because the bundle is large and pre-bundled, review is harder — inspect the code for network endpoints or unexpected behavior before running.

✓ Credentials

The skill declares no required environment variables, credentials, or config paths. This is proportionate to its stated purpose. Still, the runtime code may make outbound network requests to bank websites (expected) — it does not request secrets in metadata.

✓ Persistence & Privilege

Skill flags show always: false and normal invocation behavior. It does not request persistent privileges or system-wide config modification in metadata. The code bundle could, if malicious, perform filesystem/network actions when run, so run in a sandbox when testing.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install chinese-bank-forex-rates
安装完成后，直接呼叫该 Skill 的名称或使用 /chinese-bank-forex-rates 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v0.1.3

- Prices are now standardized to CNY per 100 units of foreign currency, rounded to two decimal places. - Invocation example updated for clarity (comma-separated currencies, removed quotes). - No code changes detected; documentation only.

v0.1.2

Change the invocation command from npm to node

v0.1.1

Replace the vulnerable axios library with native fetch to improve security.

v0.1.0

Initial release of chinese-bank-forex-rates: - Provides latest forex rates from major Chinese banks by bank/currency name. - Supports 招商银行, 中国银行, 中国农业银行, 中国工商银行, 中国建设银行, and 交通银行, including common aliases. - Returns bank name, update time, and precise buy/sell prices for requested currencies. - Follows clear price selection rules based on published bank data. - Input via bank and currency names or ISO codes; outputs data as structured JSON.

元数据

Slug chinese-bank-forex-rates

版本 0.1.3

许可证 MIT-0

累计安装 1

当前安装数 1

历史版本数 4

常见问题