DEPRECATED. Use jun-invest-option-master-agent.

Key points to consider before installing: - The skill is marked DEPRECATED in SKILL.md — prefer the recommended replacement (jun-invest-option-master-agent) unless you have a specific reason to install this older installer. - Inspect scripts/install.sh (and any other executable scripts) thoroughly before running; the package contains an install script that will copy/sync files into your filesystem and may run openclaw/clawhub commands. - AGENTS.md instructs treating certain chat phrases as a no-confirmation trigger to run an upgrade flow (clawhub update, run scripts/install.sh, openclaw agents add). That behavior can cause the agent to perform filesystem/agent-configuration changes without additional human confirmation — do not enable autonomous invocation for this skill in sensitive environments. - The repository contains a hard-coded path (/Users/lijunsheng/.openclaw/workspace-jun-invest-option-master). Running the installer as-is may try to write to a path that is user-specific; update or sanitize paths before executing. - Network access to public data sources (stooq, yfinance) and to a local broker gateway (127.0.0.1:11111) is expected for its purpose — but confirm you want those calls and that no credentials are embedded in the package. - If you need to proceed: run the install script only in an isolated/test environment or VM, and run it under a user account where you control the destination paths. Consider cloning and running the code manually (reviewing and editing the install steps) rather than invoking any automated upgrade hooks. - What would change this assessment: providing the exact contents of scripts/install.sh (to verify it only copies files and does not execute unexpected network calls), confirmation that the agent runtime will only use SKILL.md (and not AGENTS.md/SOUL.md) for autonomous behavior, or a cleaned package that removes hard-coded user paths and that documents explicit, minimal install steps would move this toward benign. Absent that, the mismatch between the minimal SKILL.md and the operational installer content (plus auto-upgrade instructions and hard-coded paths) makes the skill suspicious.

Type: OpenClaw Skill Name: jun-invest-option-master-installer Version: 0.99.0 The skill bundle is classified as suspicious due to the AI agent's explicit instructions for self-modification and self-publishing, which present a significant prompt-injection vulnerability. Files like `AGENTS.md`, `SOUL.md`, and `agent/invest_agent/prompts/Growth.md` instruct the agent to execute `clawhub update`, run `scripts/install.sh`, modify its own repository, and publish new skill versions. While intended for 'team self-growth and upgrade,' these capabilities could be exploited via prompt injection to introduce and publish malicious code, posing a supply chain risk.