Mx Selfselect

妙想自选管理skill，基于东方财富通行证账户数据及行情底层数据构建，支持通过自然语言查询、添加、删除自选股。

This skill appears to implement the stated EastMoney self-select functionality, but take these precautions before installing or running it: - Verify and supply the correct API key: the code expects MX_APIKEY (SKILL.md contains a typo referring to EASTMONEY_APIKEY). Do not set other unrelated secrets into .env unless you intend them to be read. - The script will attempt to read a .env file at the repository root if MX_APIKEY is not in the environment; inspect that file before running to ensure it contains only intended values (it may expose other secrets if present). - The script will make network requests to https://mkapi2.dfcfs.com with your API key in the request headers — only run it if you trust that endpoint and the source of the skill (the package has no homepage and unknown source). - There is a requirements.txt (requests) but no install spec. Ensure your runtime provides the requests package or install it in an isolated environment (virtualenv/container) to avoid dependency surprise. - Run the skill in an isolated environment (container or restricted VM) first, and review logs and the created files under /root/.openclaw/workspace/mx_data/output/ to confirm behavior. - Ask the publisher to: (1) fix the env var name inconsistency in SKILL.md, (2) declare the required env var in registry metadata, and (3) add an install step or note about dependencies. Given the inconsistencies and unknown source, avoid supplying high-privilege or reused credentials until you’re comfortable with the code and origin.

Type: OpenClaw Skill Name: mx-selfselect Version: 1.0.0 The mx-selfselect skill is a legitimate tool for managing stock watchlists via the East Money (Dongfang Caifu) financial API. The Python script (scripts/mx_self_select.py) correctly implements its stated functions—querying, adding, and deleting stocks—using standard libraries and secure credential handling via environment variables. No evidence of data exfiltration, malicious execution, or prompt injection was found, and the network communication is restricted to the official domain mkapi2.dfcfs.com.