← 返回 Skills 市场
74
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install portfolio-risk-sensemaker
功能描述
A plain-English portfolio reading skill that turns a holdings list into understandable risk patterns. Use when the user wants to understand the risk profile...
安全使用建议
This skill claims to be prompt-only but includes code that reads a hard-coded path under /Users/jianghaidong/.openclaw/skills/{skill_name} with no input sanitization. That enables a caller to cause the skill to read local files (path-traversal risk) and exposes a developer's home path. Before installing: (1) ask the author why the skill needs to read SKILL.md and remove that behavior if unnecessary; (2) request that file access be limited to the skill's own directory and that skill_name be validated/normalized (no '../'); (3) run the code in a sandboxed environment or review it locally; and (4) if you must install, do not grant it access to sensitive host files. If the author cannot justify the disk read, treat this as a red flag and avoid installing.
功能分析
Type: OpenClaw Skill
Name: portfolio-risk-sensemaker
Version: 1.0.0
The handler.py file contains a hardcoded absolute path referencing a specific local user directory (/Users/jianghaidong/) and lacks input validation for the skill_name parameter, which introduces a path traversal vulnerability. While the current logic reads the file without exfiltrating its content, the use of absolute paths and unvalidated input are high-risk patterns that deviate from secure coding practices for portable skill bundles.
能力标签
能力评估
Purpose & Capability
The skill is described as prompt-only and not needing any files or credentials, but handler.py contains code to load a SKILL.md from a hard-coded path (/Users/jianghaidong/.openclaw/skills/{skill_name}). Reading local skill files is unnecessary for a prompt-only portfolio analyzer and the hard-coded user path is unusual and disproportionate.
Instruction Scope
SKILL.md instructions do not mention reading disk files. The handler's _load_skill_meta opens a file based on the provided skill_name with no validation or sanitization, allowing the agent (or whoever calls handle) to trigger arbitrary file reads under that filesystem prefix — behavior outside the documented scope.
Install Mechanism
No install specification and no external downloads; the skill is instruction-only with two small local code files, so there is no elevated install risk.
Credentials
The skill declares no environment variables or credentials (consistent with its description). However, the handler's file read is an undeclared capability to access local filesystem data, which is not captured by requires.env and so is under-specified and surprising.
Persistence & Privilege
The skill is not marked always:true and does not attempt to modify other skills or global agent settings. It does, however, read from disk when invoked, which is a runtime privilege but not persistent configuration.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install portfolio-risk-sensemaker - 安装完成后，直接呼叫该 Skill 的名称或使用
/portfolio-risk-sensemaker触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release of portfolio-risk-sensemaker
- Translates user-provided crypto holdings into plain-English risk profiles.
- Highlights concentration risk, overlap, exposure imbalance, and downside scenarios.
- Offers reflection questions and notes missing information.
- Designed for easy, chart-free understanding.
- Works with percentages, buckets, or ranked lists—even if incomplete.
元数据
常见问题
Portfolio Risk Sensemaker 是什么？
A plain-English portfolio reading skill that turns a holdings list into understandable risk patterns. Use when the user wants to understand the risk profile... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 74 次。
如何安装 Portfolio Risk Sensemaker？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install portfolio-risk-sensemaker」即可一键安装，无需额外配置。
Portfolio Risk Sensemaker 是免费的吗？
是的，Portfolio Risk Sensemaker 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Portfolio Risk Sensemaker 支持哪些平台？
Portfolio Risk Sensemaker 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Portfolio Risk Sensemaker？
由 haidong（@harrylabsj）开发并维护，当前版本 v1.0.0。
推荐 Skills