功能描述

Track the dividend premium (dividend yield minus 10-year bond yield) for CSI Dividend Low Volatility Index. Monitor dividend yield, 10-year bond yield, and calculate the premium for investment decisions.

使用说明 (SKILL.md)

Dividend Premium Tracker

Name: Dividend Premium Tracker
Author: gykdly

Track the dividend premium (dividend yield minus 10-year bond yield) for CSI Dividend Low Volatility Index.

Description

This skill tracks the dividend premium for the CSI Dividend Low Volatility Index (H30269), which is crucial for investment decisions in China's dividend-focused market. The dividend premium represents the excess return of dividend-paying stocks over risk-free bonds.

What It Tracks

CSI Dividend Low Volatility Index Dividend Yield - From China Securities Index
10-Year China Government Bond Yield - From Ministry of Finance
Dividend Premium = Dividend Yield - Bond Yield

Features

📊 Auto-download and track dividend and bond yield data
📈 Generate Excel reports with clean charts
🔔 Alert when bond yield rises for 3 consecutive days
🔔 Alert when premium drops below 1%
📅 Support for historical data backfill

Commands

Update Today's Data

python3 scripts/update_dividend_premium.py --update

Check Monitoring Alerts

python3 scripts/monitor_dividend_premium.py --check

Backfill Historical Data

python3 scripts/update_dividend_premium.py --backfill 2026-01-01 2026-01-31

Files

dividend-premium-tracker/
├── SKILL.md              # This file
├── scripts/
│   ├── update_dividend_premium.py   # Main update script
│   └── monitor_dividend_premium.py  # Monitoring script
├── references/           # Documentation (optional)
└── assets/              # Output files (optional)

Setup

Telegram Alerts (Optional)

Set Telegram Bot Token for alerts:

export TELEGRAM_BOT_TOKEN="your_bot_token_here"

Cron Job (Daily Update)

crontab -e
# Add line:
0 17 * * * cd /path/to/skill && python3 scripts/update_dividend_premium.py --update

Data Sources

Data	Source	URL
Dividend Yield	China Securities Index	H30269 Indicator XLS
Bond Yield	Ministry of Finance	ChinaBond

Alert Thresholds

Condition	Action
Bond yield rises 3 consecutive days	Telegram alert
Premium \x3C 1%	Telegram alert

Requirements

Python 3.10+
pandas
openpyxl
xlrd
curl (for data download)

Usage Notes

Premium is calculated as: Dividend Yield (%) - Bond Yield (%)
Premium \x3C 1% suggests potential buying opportunity
Premium \x3C 0 indicates dividend stocks are cheaper than bonds
Historical data from 2026-01-14 to present included

Related Indices:

CSI Dividend Low Volatility Index (H30269/000966)
10-Year China Government Bond

安全使用建议

This skill implements the advertised tracking but has several red flags you should address before running it with your real data or credentials: 1) Fix the unit/logic inconsistency: the two scripts calculate 'premium' differently (one subtracts, the other multiplies dividend rate by 100), so verify which is correct for your data. 2) Remove or make configurable the absolute DATA_DIR (/Users/liyi/.openclaw/workspace) so files are saved where you expect. 3) Remove the hard-coded TELEGRAM_CHAT_ID or make the chat id configurable: currently alerts target a fixed numeric chat id (likely the developer's), which is unexpected and could leak alerts. 4) Review and fix bugs in generate_excel (there are references to an undefined 'data' and strange chart scale settings) before trusting generated reports. 5) Only set TELEGRAM_BOT_TOKEN if you intend the included bot to send messages and you trust where messages will be delivered; consider testing with a disposable bot and your own chat id first. 6) Run the scripts in a sandbox or test environment first to confirm behavior and outputs. Given the inconsistencies and hard-coded endpoints/paths, treat this as suspicious rather than benign until those issues are resolved.

功能分析

Type: OpenClaw Skill Name: dividend-premium-tracker Version: 1.0.1 The skill is classified as suspicious due to the use of `os.system()` with f-strings for executing `curl` commands in `scripts/monitor_dividend_premium.py` and `scripts/update_dividend_premium.py`. While the current usage involves hardcoded URLs and internally generated messages, this pattern introduces a shell injection vulnerability, which could lead to arbitrary command execution if inputs were to become untrusted. There is no evidence of intentional malicious behavior such as data exfiltration, unauthorized remote control, or stealthy backdoors; the functionality aligns with the stated purpose of financial tracking and alerting.

能力评估

ℹ Purpose & Capability

Name/description match the scripts' functionality: they download index and bond yield data and compute a dividend premium. However, the implementation shows inconsistencies (two different premium calculations: one script uses div_rate - bond_yield, the other uses div_rate * 100 - bond_yield) and assumptions about data units that are not documented. These inconsistencies mean results may be incorrect even though the intended purpose is aligned.

⚠ Instruction Scope

SKILL.md instructs running the included scripts and optionally setting TELEGRAM_BOT_TOKEN. The scripts access only known public endpoints (csindex and chinabond) and write local CSV/Excel files, which is expected. Concerns: both scripts write to a hard-coded absolute DATA_DIR (/Users/liyi/.openclaw/workspace) rather than a configurable path; monitor script hard-codes TELEGRAM_CHAT_ID = "505395883" (messages would be sent to that chat id if the bot token is accepted); and the code uses os.system/subprocess to call curl. There is no instruction in SKILL.md warning about the hard-coded path or chat id.

✓ Install Mechanism

No install spec; scripts are included as files and rely on Python and curl. This is the lowest-risk install mechanism (nothing is downloaded/installed at runtime by the skill itself).

⚠ Credentials

No required environment variables are declared, and the SKILL.md mentions an optional TELEGRAM_BOT_TOKEN. That is reasonable for alerts, but the code also hard-codes a TELEGRAM_CHAT_ID. If a user supplies a bot token, the script will attempt to send messages to that hard-coded chat id (likely the developer's), which is unexpected behavior: alerts probably should go to a user-configurable chat id. No other credentials are requested, which is proportional.

✓ Persistence & Privilege

The skill is not set to always:true and does not request elevated system privileges or modify other skills/configs. It writes files to a fixed local path (which is a privilege to write to that path, but not a platform-level persistence flag).

版本历史

v1.0.1

- Added _meta.json file for enhanced metadata support. - Updated SKILL.md to include front matter with name, description, and version fields. - No changes to functionality or feature set.

v1.0.0

跟踪中证红利低波指数股息率与10年国债收益率的溢价，计算股息率溢价，监控买卖时机

元数据

Slug dividend-premium-tracker

版本 1.0.1

许可证 —

累计安装 2

当前安装数 1

历史版本数 2

常见问题