← 返回 Skills 市场
eastmoney skills
作者
eastmoney_dev
· GitHub ↗
· v1.0.2
· MIT-0
938
总下载
1
收藏
7
当前安装
3
版本数
在 OpenClaw 中安装
/install mx-skills
功能描述
东方财富妙想提供的金融技能集合，涵盖金融数据查询、资讯搜索、智能选股、自选股管理和模拟组合管理，所有技能均需通过MX_APIKEY进行认证。
安全使用建议
This skill is plausible (financial API usage with an API key) but several red flags mean you should be cautious: 1) The registry metadata does NOT list the MX_APIKEY or Node requirement even though SKILL.md requires them — ask the publisher to correct the manifest. 2) The installation instructs downloading and extracting multiple zip files from an external host (marketdfs.dfcfw.com) with no integrity checks — verify the URLs and obtain signed releases or inspect archives in a sandbox before running. 3) The provided install script contains syntax errors and uses rm -rf on a pattern; do not run it as-is or as root. 4) Prefer to manually inspect downloaded SKILL.md/SKILL files and run installations in an isolated environment (VM/container) and only provide your MX_APIKEY after confirming the publisher and URLs. If you cannot verify the source or get corrected metadata, treat this as untrusted and avoid installing.
功能分析
Type: OpenClaw Skill
Name: mx-skills
Version: 1.0.2
The skill bundle acts as a meta-installer that instructs the agent to execute shell commands (curl, unzip, rm) to download and extract multiple remote ZIP archives from marketdfs.dfcfw.com into the ~/.openclaw directory. While these actions are aligned with the stated purpose of installing financial tools, the pattern of fetching and executing remote content via agent instructions represents a significant supply chain risk and potential RCE vector if the source is compromised, warranting a suspicious classification despite the lack of explicit malicious intent.
能力评估
Purpose & Capability
The SKILL.md clearly requires an MX_APIKEY and checks for Node.js, but the registry metadata provided to the platform lists no required env vars or binaries. Requiring Node.js (Node 22+) is not justified by the shown runtime steps (no node commands are executed), while the functionality (financial data/search/portfolio management) legitimately needs an API key. The mismatch between declared metadata and the document is an incoherence.
Instruction Scope
The runtime instructions tell the user/agent to rm -rf ~/.openclaw/skills/mx-skills* (removing existing similarly named skills), download multiple zip files from external URLs, unzip them into ~/.openclaw/skills, and prompt the user for an API key. These steps go beyond simple in-agent calls and involve modifying the user's skill directory and executing network downloads. The script also has several obvious shell syntax problems (missing $ on variables, extra spaces in assignments, use of /temp instead of common /tmp) which suggests low quality and potential for unintended behavior.
Install Mechanism
Although the skill bundle has no formal install spec, the SKILL.md directs downloading and extracting multiple zip archives from marketdfs.dfcfw.com and placing them under ~/.openclaw/skills. Downloading and extracting archives from an external host (not a well-known release host like GitHub releases) is higher risk because the contents will be written to disk and potentially executed. There are no integrity checks or signatures shown.
Credentials
The SKILL.md requires an MX_APIKEY (used for API authentication) which is proportionate to the described financial capabilities; however, the platform metadata omitted declaring this required env var. The skill only requests a single API key (reasonable), but the mismatch between manifest and instructions increases risk because automatic tooling or users may not realize a secret is needed or where it will be used.
Persistence & Privilege
always:false (normal). The instructions write into ~/.openclaw/skills and explicitly remove existing mx-skills* directories — modifying the user's skills directory is expected for installing a skill but the rm -rf pattern can be destructive if used carelessly. The skill does not request system-wide privileges or other credentials, and it does not demand permanent/autonomous inclusion beyond the platform defaults.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install mx-skills - 安装完成后，直接呼叫该 Skill 的名称或使用
/mx-skills触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.2
- 更新了技能子模块的下载链接，现全部指向东方财富官方 marketdfs.dfcfw.com 文件下载地址
- 在元数据字段中增加了 required env vars 和 环境变量 字段，用于强化环境变量说明（不影响实际功能）
- 其余 skill 描述及功能保持不变
v1.0.1
Initial release of 东方财富妙想金融技能集合 (version 1.0.0):
- Introduces a comprehensive financial skill set for 东方财富妙想, including data query, news search, intelligent stock selection, self-selected stock management, and portfolio simulation.
- All sub-skills require authentication via MX_APIKEY.
- Provides detailed installation and environment setup instructions, including acquiring and managing the required API key.
- Supports easy skill downloading, verification, and usage for local environments (Node.js 22+ required).
- Ensures users can manage and verify sub-skills individually after installation.
v1.0.0
- Initial release of mx-skills, a collection of financial skills provided by 东方财富妙想.
- Includes capabilities for financial data queries, news and research search, intelligent stock selection, self-selected stock management, and portfolio simulation.
- All skills require authentication via MX_APIKEY, obtainable from 东方财富技能市场.
- Provides detailed installation and verification instructions for local usage, including API key setup and file validation steps.
元数据
常见问题
eastmoney skills 是什么？
东方财富妙想提供的金融技能集合，涵盖金融数据查询、资讯搜索、智能选股、自选股管理和模拟组合管理，所有技能均需通过MX_APIKEY进行认证。 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 938 次。
如何安装 eastmoney skills？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install mx-skills」即可一键安装，无需额外配置。
eastmoney skills 是免费的吗？
是的，eastmoney skills 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
eastmoney skills 支持哪些平台？
eastmoney skills 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 eastmoney skills？
由 eastmoney_dev（@qqk000）开发并维护，当前版本 v1.0.2。
推荐 Skills