Noah Stock Market

用于港股和美股市场数据查询与结构化行情摘要。当用户询问股票当前价格、最新行情、市场快照、分时走势、K线、盘口摆盘、逐笔成交、经纪队列、市场是否开盘、个股资金流向、板块与板块成分股、股票基础信息、期权到期日或期权链等场景时使用。适用于 HK-00700、US-AAPL 这类标准代码，也适用于用户直接输入股票名称或简...

Key things to consider before installing: - The skill documentation requires an internal API key (NOAH_MARKET_APIKEY) and base URL, but the registry metadata does not declare any required environment variables — ask the maintainer to correct the manifest so the required secret is explicit. Don’t proceed until you know exactly which credential(s) are needed and why. - The package contains many Python scripts that will be executed by the agent; there is no install/runtime dependency list. Review scripts/run_query.py and scripts/quote_client.py locally to confirm they only call the documented internal API and do not send secrets elsewhere. Run them in a controlled, offline environment first. - The skill advertises 'wealth' queries (balances/total assets). Confirm whether those endpoints return account-specific private data and what credentials they require; avoid providing account-scoped credentials unless you trust the source and have audited the code that accesses them. - Verify the skill source (owner ID has no homepage provided). Prefer installing only if you can access the repository to inspect code and confirm no hidden endpoints or telemetry; insist the author update the registry metadata to list NOAH_MARKET_APIKEY and NOAH_API_BASE_URL as required env vars and to provide dependency/install instructions. - If you decide to test, use a non-production or scoped API key and run the provided smoke_test locally to validate behavior; never paste real tokens into chat or public fields.

Type: OpenClaw Skill Name: noah-stock-market Version: 1.2.10 The skill bundle is a well-structured tool for querying Hong Kong and US stock market data via an internal corporate API. The code in 'scripts/quote_client.py' and 'scripts/run_query.py' correctly handles authentication by reading secrets from a local environment file and includes explicit instructions in 'SKILL.md' to prevent the AI agent from leaking sensitive information (like API keys or internal URLs) to the end-user. There is no evidence of malicious intent, data exfiltration to unauthorized domains, or harmful prompt injection; the logic is strictly aligned with the stated purpose of providing read-only financial market summaries.