my_stock_report_skill

当且仅当用户明确提到使用报告引擎、分析引擎、股票引擎、report engine 或者 my_stock_report_skill 时触发。用于调用 Python 分析引擎对特定美股标的进行多维度深度分析，支持指定分析师组合，并将结论和报告归档至钉钉多维表。

Before installing or enabling this skill, verify the following: 1) Confirm where run_cli.py and the Python virtual environment should live and that you trust the run_cli.py code — the skill will execute it and read files it produces (decision.txt, complete_report.md). 2) Ask the publisher or owner for explicit information about authentication: what supplies OPERATOR_ID and any DingTalk credentials? The SKILL.md calls https://api.dingtalk.com directly but lists no required env vars or tokens—do not assume credentials exist. 3) Validate the hard-coded Workspace ID and nodeId: ensure these are intended for your DingTalk workspace and not someone else’s. Hard-coded IDs can cause misdelivery of sensitive reports. 4) Confirm the presence and permission model of the referenced skills ('dingtalk-document' and 'my_stock_report_mgnt_skill'). Understand what credentials they need and who controls those credentials. 5) If you cannot confirm the above, treat the skill as potentially able to leak report contents to an external DingTalk workspace; either request a version that declares required credentials explicitly, or run the analysis and upload steps in an isolated environment under your control. 6) Note: no install-time downloads reduces supply-chain risk, but source is unknown and there is no homepage—exercise extra caution and prefer testing in a sandbox.

Type: OpenClaw Skill Name: my-stock-report-skill Version: 1.0.4 The skill bundle automates stock analysis by executing a local Python script (run_cli.py) and uploading the results to DingTalk. It is classified as suspicious primarily due to hardcoded DingTalk Workspace and Node IDs (p48ggSGelW2WAo87, 9E05BDRVQ23be3xQF2pwLjkvJ63zgkYA) in SKILL.md, which directs all generated reports to a specific external destination. While this may be intended for a specific organizational setup, hardcoding such identifiers in a skill bundle facilitates data exfiltration and lacks the necessary configuration flexibility for safe general use.