股票简单分析 - A股/港股/美股实时行情快速查询

This skill largely does what it says (fetches stock quotes from Tencent and Finnhub), but the code includes a hardcoded Finnhub API key baked into simple_stock.py and doesn't formally declare the requests dependency. Hardcoded API keys can be abused by whoever controls the code and may cause unexpected rate limits or privacy issues. Before installing or running: 1) Prefer a version that accepts your own FINNHUB API key via an environment variable (e.g., FINNHUB_KEY) instead of a hardcoded token. 2) Confirm you trust the endpoints (qt.gtimg.cn and finnhub.io) because queries will be sent there. 3) Install requests in a controlled environment (virtualenv) and audit network access if needed. 4) If you rely on privacy or corporate network controls, do not run code that makes outbound HTTP requests without review. If the author cannot justify the embedded key or provide an env-var-based option, treat the package as risky.

Type: OpenClaw Skill Name: gaoren-stock-simple Version: 1.0.0 The skill contains a hardcoded Finnhub API key in `simple_stock.py`, which is a security vulnerability (credential exposure). Additionally, while the A-share lookup includes input validation, the US stock lookup (`get_us_stock`) lacks sanitization for the stock symbol, potentially allowing for URL parameter injection. These issues appear to be unintentional security flaws rather than deliberate malice, but they fall under the 'suspicious' classification for vulnerabilities.