← 返回 Skills 市场
gm4leejun-stack

jun-invest-option-master (DEPRECATED)

作者 gm4leejun-stack · GitHub ↗ · v0.99.0
cross-platform ⚠ suspicious
450
总下载
0
收藏
0
当前安装
9
版本数
在 OpenClaw 中安装
/install jun-invest-option-master
功能描述
DEPRECATED. Use jun-invest-option-master-agent.
使用说明 (SKILL.md)

DEPRECATED: jun-invest-option-master

此 skill 已废弃。

请改用:jun-invest-option-master-agent

安全使用建议
This package is inconsistent: the short SKILL.md marks it DEPRECATED, but the bundle contains a full invest-agent app with installer scripts and explicit instructions to run upgrade/install commands. Before installing or running anything: 1) do not run scripts/install.sh or setup-launchd.sh unreviewed — open them and inspect what they do; 2) watch for hardcoded paths (/Users/lijunsheng...) and adjust to your environment; 3) verify any network/broker integrations (futu-api expects a local OpenD and possibly credentials) and never paste secrets into repo files; 4) prefer the recommended replacement skill (jun-invest-option-master-agent) if available; 5) if you must test, run inside a sandbox or disposable VM and avoid running installer scripts as root. If you want, I can summarize the contents of specific scripts (install.sh, setup-launchd.sh, publish.sh) or highlight exact lines that modify system files so you can audit them quickly.
功能分析
Type: OpenClaw Skill Name: jun-invest-option-master Version: 0.99.0 The skill installs a macOS LaunchAgent (`scripts/setup-launchd.sh`) for persistence, which periodically executes `scripts/publish.sh`. This `publish.sh` script is designed to automatically publish the skill's code to ClawHub, building a version and changelog from local git commits. Furthermore, the `agent/AGENTS.md` and `agent/SOUL.md` files contain explicit prompt-injection instructions for the AI agent to perform these self-modification, git commit, and self-publishing actions. While the stated purpose is self-management and distribution of the skill itself, the combination of persistent execution, self-publishing of code to a public platform, and direct AI instructions to do so represents a high-risk capability that could be leveraged for unintended or malicious purposes if the agent's integrity were compromised.
能力评估
Purpose & Capability
The registry SKILL.md simply says 'DEPRECATED' and points to another skill, but the published bundle includes a complete invest_agent app (prompts, adapters, assembler/validator, and many scripts). That makes the published content far larger and more operational than the minimal 'deprecated' message implies. The included adapters (Futu, yfinance, stooq) and network access are coherent with an investment agent, but presence of installer scripts and hard-coded user workspace paths (e.g., /Users/lijunsheng/.openclaw/workspace-jun-invest-option-master) is unexpected for a simple deprecation notice.
Instruction Scope
While SKILL.md is minimal, other runtime docs (agent/AGENTS.md, BOOTSTRAP.md, SOUL.md) explicitly instruct automated behaviors: treat specific user utterances like 'upgrade agent' as a command to run a fixed upgrade sequence (clawhub update, run scripts/install.sh, openclaw agents add, possibly restart gateway). Those instructions ask the agent to execute shell-level operations and to sync/install code into user workspaces without additional user confirmation, which expands scope beyond mere read-only assistance. The docs also reference modifying system services (setup-launchd.sh) and installer scripts that can change files on disk.
Install Mechanism
There is no formal install spec in the registry, but the repository includes multiple installer and setup scripts (scripts/install.sh, auto-install.sh, setup-launchd.sh, setup-runtime-git.sh, publish.sh). Running those scripts could write files, configure launchd jobs, or change the OpenClaw workspace. Because the registry claims 'no install spec' while shipping runnable installers, an agent following repo instructions might execute arbitrary local changes. The scripts are local (not remote downloads), but their actions should be audited before execution.
Credentials
The skill declares no required environment variables or credentials, yet the code integrates with futu-api (broker/OpenD) and yfinance and expects a local OpenD (127.0.0.1:11111) and Python packages (futu-api, yfinance). The project documentation says secrets won't be bundled and should be provided via environment or local config, but the registry metadata does not declare those env vars. Hardcoded example paths and owner fields (owner: shengge; /Users/lijunsheng) are present, which is inconsistent and could cause surprising behavior if installer scripts assume those paths.
Persistence & Privilege
The skill is not marked always:true, and is user-invocable (normal). However the repo contains scripts capable of making persistent system changes (e.g., setup-launchd.sh) and AGENTS.md defines an automatic 'upgrade' trigger that, if followed by an agent runtime, would execute installer steps. That combination increases the potential blast radius if the agent is allowed to run commands derived from this skill; it's not automatically privileged by registry flags, but it contains code that can request persistence.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install jun-invest-option-master
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /jun-invest-option-master 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v0.99.0
deprecated: use jun-invest-option-master-agent
v0.2.202603041121
05617dc chore: restore runtime + delivery loop de2f020 chore: remove test line ca6650c test: trigger sync c4de8ce bootstrap: runtime workspace
v0.2.202603041120
05617dc chore: restore runtime + delivery loop de2f020 chore: remove test line ca6650c test: trigger sync c4de8ce bootstrap: runtime workspace
v0.2.202603041119
05617dc chore: restore runtime + delivery loop de2f020 chore: remove test line ca6650c test: trigger sync c4de8ce bootstrap: runtime workspace
v0.2.202603041118
05617dc chore: restore runtime + delivery loop de2f020 chore: remove test line ca6650c test: trigger sync c4de8ce bootstrap: runtime workspace
v0.2.1
Deprecate: use jun-invest-option-master-installer to avoid name collision with agentId
v0.2.0
Add auto-install workflow: chat-driven fixed steps + scripts/auto-install.sh
v0.1.1
Fix SKILL.md frontmatter for OpenClaw skill discovery; clarify restore steps
v0.1.0
Initial release: agent app pack (prompts/config/templates + install scripts)
元数据
Slug jun-invest-option-master
版本 0.99.0
许可证
累计安装 0
当前安装数 0
历史版本数 9
常见问题

jun-invest-option-master (DEPRECATED) 是什么?

DEPRECATED. Use jun-invest-option-master-agent. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 450 次。

如何安装 jun-invest-option-master (DEPRECATED)?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install jun-invest-option-master」即可一键安装,无需额外配置。

jun-invest-option-master (DEPRECATED) 是免费的吗?

是的,jun-invest-option-master (DEPRECATED) 完全免费(开源免费),可自由下载、安装和使用。

jun-invest-option-master (DEPRECATED) 支持哪些平台?

jun-invest-option-master (DEPRECATED) 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 jun-invest-option-master (DEPRECATED)?

由 gm4leejun-stack(@gm4leejun-stack)开发并维护,当前版本 v0.99.0。

💬 留言讨论