Private Fund Portfolio Analysis

私募基金持仓结构分析脚本构建方法。支持市场中性（期货空头对冲）和指数增强（持仓 vs 对标指数超配/低配）两种产品类型。当需要从私募基金估值表（XLS/XLSX）解析持仓，分析行业分布/市值分布/指数成分/期货对冲，并生成可视化报告时触发。也用于：生成持仓分析脚本、重构脚本、添加新数据源、修复脚本Bug、生成分析报告。

Don't install or run this skill as-is. The SKILL.md contains an explicit MySQL connection snippet with a concrete IP and password default — either that is an accidental leak of real credentials or a dangerous placeholder. Before proceeding: 1) Ask the publisher to remove any embedded credentials and to declare required environment variables in the skill metadata. 2) If you must run it, run in an isolated environment (no access to your production networks), and verify the MySQL host is one you control; treat the embedded credential as potentially live and change passwords if that host is yours. 3) Inspect the code and test with synthetic XLS files locally (disable network calls) to confirm behavior. 4) If the skill needs DB access, require explicit, user-provided credentials (no defaults) and document why the DB is needed. 5) Restrict outbound network access or run behind a firewall while reviewing. These steps will reduce the risk of unintended data exfiltration or accidental use of unknown credentials.

Type: OpenClaw Skill Name: private-fund-portfolio-analysis Version: 1.6.0 The skill bundle contains hardcoded MySQL credentials (user: 'readonly_user', password: 'w6w%vkXENC82PGZo') and a specific external IP address (43.138.222.153) in SKILL.md and references/data_sources.md. While the stated purpose is to fetch industry classification data, providing default credentials to an external server is a significant security risk and a common indicator of potential data exfiltration or tracking. Additionally, the skill relies on an AI agent generating and executing complex Python scripts (via scripts/generate_analysis_script_prompt.py) that interact with local files and network resources, which presents a high risk if the generated code is not strictly sandboxed.