光通信投资分析框架

AI光通信产业链投资分析框架（自迭代）。基于闷得而蜜160篇专栏+查尔斯大风车15篇长文的系统性整理，支持持续学习新帖自动追加。用于：(1)分析光通信相关股票（光模块/光芯片/PCB/CPO/NPO/OCS概念股），(2)判断技术路线（InP/硅光/TFLN/CPO/NPO/XPO），(3)评估标的质量（九字诀/...

This skill appears to be a legitimate investment analysis framework, but its optional self-update feature asks the agent to use browser automation with an "already logged" Chrome profile. That can expose session cookies and other browser state. Before installing or enabling the self-update capability: 1) Prefer using the analysis functions without enabling automated updates; request/submit new posts/URLs manually instead of granting browser-profile access. 2) If you want automatic updates, require the skill author to declare that dependency in metadata and explain exactly what browser-tool and profile access is needed and how credentials/session data are isolated and not exfiltrated. 3) Verify platform-level sandboxing for the browser tool: confirm it cannot read other browser profiles or arbitrary local files and that it does not leak cookies to remote endpoints. 4) Ensure the skill cannot run autonomous updates without explicit, per-update user consent; consider turning off autonomous invocation or adding an approval gate. 5) Review the appended reference files (and the update log) after any update to confirm only the intended content was added and nothing sensitive was captured. If you are not comfortable granting browser-profile access, use the skill in read-only/manual-update mode.

Type: OpenClaw Skill Name: optical-comm-investing Version: 2.0.0 The skill bundle provides an investment analysis framework for optical communications with a 'self-iteration' feature that instructs the AI agent to use browser tools to scrape external content from Xueqiu (xueqiu.com). Critically, SKILL.md requests the use of a logged-in browser profile (profile='user') to access full article text, which poses a significant risk of session/cookie exposure. Furthermore, the automated process of reading and 'extracting' information from untrusted external web posts into local reference files creates a major surface for indirect prompt injection, where malicious content on the target website could hijack the agent's execution logic.