港股+A股实时盯盘系统，支持技术分析、涨跌幅告警、飞书推送。使用场景：(1) 查询港股/A股实时行情，(2) 监控股票涨跌幅告警，(3) 生成技术分析报告，(4) 定时推送盯盘报告。触发关键词：盯盘、股票监控、港股行情、A股行情、涨跌告警、技术分析。

This skill largely behaves like a stock-monitoring/alerting tool, but take these precautions before installing or running it: - Do not trust the hard-coded QVeris API key in the source. Treat it as a secret leakage risk; rotate the key if it is yours, or remove it and require the user to supply QVERIS_API_KEY via environment variables. - The SKILL.md lists no required env vars but the code uses QVERIS_API_KEY. Ask the author to declare required env vars (and remove embedded secrets) or refuse to use the hard-coded default. - The scripts write state and data to absolute paths under /root/.openclaw/... and /var/log in the suggested cron. Ensure these paths are appropriate for your environment and that you run the scripts with a least-privileged account (do not run as root unless you intend to). Consider changing paths to a dedicated, non-root workspace. - The code execs an external qveris-official script (node qveris_tool.mjs) by cd'ing into /root/.openclaw/workspace/skills/qveris-official. Verify that file exists and inspect it for malicious behavior before running. If that dependency is not present, the skill shells out to execute code in another skill's workspace — this increases risk. - The scripts call openclaw message send via child_process.execSync to deliver Feishu messages. Confirm what openclaw message send does in your environment and that the chatId is correct. If you don't want messages sent automatically, remove or stub out sendAlert calls while testing. - Run the code in an isolated environment (container or VM) first, and review/modify the code to remove hard-coded credentials and absolute paths. Provide QVERIS_API_KEY via environment only if you trust QVeris and have a paid account. What would change this assessment: if the author published a clear README stating the external qveris dependency, removed the hard-coded API key and declared required env vars, and replaced absolute /root paths with configurable relative paths, the concerns would be largely resolved and the skill would look coherent and lower risk. If you cannot verify or remove the hard-coded key and the external script, treat installation as risky.

Type: OpenClaw Skill Name: hk-stock-monitor Version: 1.0.0 The skill bundle contains hardcoded sensitive credentials, including a QVeris API key and a specific Feishu Chat ID (oc_c771930429ba9d9683b8a38fe3a9b3f9) in 'data-sources.js' and 'alert-check.js', which could lead to monitoring data being sent to the author's endpoint. Additionally, the scripts use 'execSync' with unsanitized string interpolation to call the OpenClaw CLI and external tools, introducing a high risk of shell injection. While the behavior aligns with the stated stock monitoring purpose, the combination of hardcoded secrets and insecure command execution is highly irregular for a public skill.