AI Market Intelligence Agent

自动监控并聚合多平台市场和行业数据，生成定制化报告，洞察趋势、机会、风险及竞品动态。

This skill is inconsistent: it advertises automated multi‑platform monitoring but the included main.sh only creates a static report template and does not fetch data. README and package.json mention API keys and a setup.sh that is not present. Before installing or providing any API keys, consider: 1) treat this as a stub — it likely needs additional code to perform real data collection; 2) ask the publisher for the missing setup.sh or source repository and verify how API keys are used; 3) do not supply secrets until you confirm network endpoints and code that consumes them; 4) run the skill in a sandboxed environment first to observe behavior. If you expect production data aggregation, prefer a skill whose code actually implements authenticated API calls and documents required credentials and endpoints.

Type: OpenClaw Skill Name: market-intelligence Version: 1.0.0 The skill is classified as suspicious due to a critical shell injection vulnerability in `main.sh`. User-controlled arguments (`$KEYWORD`, `$PLATFORM`, `$PERIOD`) are directly embedded into a heredoc (`cat > "$output_file" << EOF`) without quoting the `EOF` marker, allowing command substitution (`$(command)`) to be executed by the shell. This constitutes a Remote Code Execution (RCE) risk if an attacker can control these inputs. Additionally, the direct embedding of these variables into the Markdown report allows for Markdown injection. There is no evidence of intentional malicious behavior like data exfiltration or backdoors, classifying it as a severe vulnerability rather than outright malware.