← 返回 Skills 市场
M估值法
作者
oldhouse-g
· GitHub ↗
· v1.0.0
398
总下载
0
收藏
1
当前安装
1
版本数
在 OpenClaw 中安装
/install m-valuation
功能描述
基于ROIC和CAPM的5步股票估值方法，提供资格筛选、内在价值计算及风险与情景分析。
使用说明 (SKILL.md)
M估值法
基于ROIC和CAPM的股票估值方法，由蟹老板创建。
概述
完整的5步股票估值分析框架：
- 资格筛选（ROIC > w）
- 核心参数计算
- 内在价值计算
- 估值决策与风险分析
- 情景分析
使用方法
当用户说"用M估值法分析[股票]"时，使用此skill：
python3 ~/.openclaw/workspace/skills/m-valuation/valuation.py \x3C股票代码> [名称]
# 示例
python3 ~/.openclaw/workspace/skills/m-valuation/valuation.py 000333 美的集团
python3 ~/.openclaw/workspace/skills/m-valuation/valuation.py 600036 招商银行
触发词
- "M估值法"
- "用M估值法分析"
- "M估值"
数据来源
- Tushare API - A股财务数据
- Tavily搜索 - 获取β系数、非A股数据
核心公式
- w = Rf + β × (Rm - Rf)
- d = 分红率 = D₀/E
- g = (1-d) × ROIC
- PE = d × (1+g) / (w - g)
- 预期收益率 = 股息率 + g
输出内容
- 资格筛选结果
- 核心参数（股息率、预期收益率）
- 内在价值
- 风险分析（股息风险、成长风险）
- 情景分析（零增长/3%增长PE）
- 投资建议
安全使用建议
This skill likely implements the advertised valuation method, but it has several red flags you should address before installing or running it: (1) The Python file contains hardcoded API keys (a TAVILY_API_KEY and a Tushare pro token). Do not run it if you do not trust these keys or their owner — they may be tied to someone else’s account or be abused. (2) The script calls a Node script at an absolute path (/root/.openclaw/.../tavily-search/scripts/search.mjs) and requires the 'node' binary and the 'tushare' Python package, none of which are declared in the manifest. Confirm those dependencies and that the referenced Node script is legitimate. (3) Prefer that the author remove hardcoded credentials and instead accept user-provided API keys via declared env vars, and explain/install required binaries. (4) If you want to test it: run in an isolated sandbox/container, monitor network calls, and replace the embedded tokens with your own keys (or delete them) before using. Ask the publisher to (a) declare required binaries and env vars, (b) remove or justify embedded keys, and (c) avoid absolute /root paths so the skill is portable and auditable.
功能分析
Type: OpenClaw Skill
Name: m-valuation
Version: 1.0.0
The `valuation.py` script contains hardcoded API keys for both Tavily and Tushare, which is a significant security vulnerability as it exposes credentials. Additionally, the script uses `subprocess.run` to execute an external Node.js script (`tavily-search/scripts/search.mjs`) and passes user-controlled input (stock name/code) as arguments. While the input is passed as distinct arguments, this pattern creates a potential second-order shell injection vulnerability if the `search.mjs` script itself is not robust against argument injection, allowing for arbitrary command execution. These issues are security flaws rather than clear evidence of intentional malicious behavior.
能力评估
Purpose & Capability
The skill claims to perform ROIC/CAPM valuation using Tushare and 'Tavily' search. However, the code embeds a hardcoded TAVILY_API_KEY and a hardcoded Tushare pro token (pro_api call) instead of declaring required credentials. The manifest declares no required env vars or binaries, but the script clearly depends on the 'tushare' Python package, the 'node' binary, and a local Node script at an absolute path (/root/.openclaw/workspace/skills/tavily-search/scripts/search.mjs). Those dependencies and credentials are not reflected in the skill metadata and are disproportionate to what the SKILL.md states.
Instruction Scope
SKILL.md instructs the agent to run the included Python script for valuation (in-scope). The script however invokes external Node search scripts via subprocess (sending text queries to a tavily-search script), sets an API key in the environment at runtime, and uses a hardcoded Tushare API token. The code thus performs network searches and remote API calls beyond the single-step valuation described in the SKILL.md; it also relies on a specific local filesystem layout (/root/...) which is not documented. While these actions could be legitimate for data collection, they expand the runtime scope without being declared.
Install Mechanism
There is no install spec but the code depends on external tooling: 'node' and a local Node script, plus the 'tushare' Python package. The manifest lists no required binaries or packages. The skill therefore risks failing or invoking unexpected local scripts/executables (absolute /root path). No package provenance or install safety is provided.
Credentials
The skill declares no required environment variables or credentials, yet the code sets os.environ['TAVILY_API_KEY'] to a literal API key and calls ts.pro_api(...) with a hardcoded token. Hardcoded credentials are a red flag: they may be leaked/stolen credentials or tie API usage to the author's account. The script overwrites/sets an env var at process startup without declaring it, and it does not provide a way to supply the user's own credentials via declared env vars.
Persistence & Privilege
The skill does not request persistent installation (always: false) and does not appear to modify system-wide settings or other skills. It does set an environment variable only within the process and invokes subprocesses. That limits persistence, but the subprocesses call remote services and depend on local scripts, increasing runtime risk. No evidence of writing persistent credentials or altering other skills was observed in the provided files.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install m-valuation - 安装完成后，直接呼叫该 Skill 的名称或使用
/m-valuation触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
M估值法 skill 1.0.0 — 基于ROIC和CAPM的股票估值分析框架上线。
- 支持完整5步股票估值流程，包括筛选、参数计算、内在价值、风险与情景分析。
- 命令行支持：python3 ~/.openclaw/workspace/skills/m-valuation/valuation.py <股票代码> [名称]。
- 提供A股与非A股（通过Tushare API与Tavily搜索）财务及β系数数据获取。
- 输出涵盖资格筛选、核心估值参数、价值与风险结论，以及投资建议。
- 集成多种触发词：“M估值法”“用M估值法分析”“M估值”。
元数据
常见问题
M估值法 是什么？
基于ROIC和CAPM的5步股票估值方法，提供资格筛选、内在价值计算及风险与情景分析。 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 398 次。
如何安装 M估值法？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install m-valuation」即可一键安装，无需额外配置。
M估值法 是免费的吗？
是的，M估值法 完全免费（开源免费），可自由下载、安装和使用。
M估值法 支持哪些平台？
M估值法 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 M估值法？
由 oldhouse-g（@oldhouse-g）开发并维护，当前版本 v1.0.0。
推荐 Skills