PyWenCai Stock

使用 pywencai 库获取同花顺问财股票数据，支持实时行情、财务指标、龙虎榜、资金流向等查询。适用于需要快速获取A股市场数据的场景。

This skill appears to do what it says: wrap the third‑party pywencai library to fetch A‑share data. Before installing, consider the following: - Review and trust the upstream pywencai package (pip). It will make network requests to retrieve data; inspect its code or pin a specific version if you need stability/trust. - Do NOT apply the SSL-disable snippet from the troubleshooting section in production; it makes HTTPS connections insecure and can enable man‑in‑the‑middle attacks. - The example script adds '/tmp/mootdx' to sys.path — harmless by itself, but avoid running arbitrary example scripts that modify import paths in sensitive environments. - If you must supply login cookies or any credentials to access additional data, treat them as sensitive: provide them only in secure ways, prefer temporary/session tokens, and avoid embedding them in code. - Run initial tests in an isolated environment (virtualenv/container) to observe network behavior and confirm no unexpected endpoints are contacted. Overall the package is internally consistent with its stated purpose; the main residual risk is trusting the third‑party pywencai package and following the insecure SSL workaround.

Type: OpenClaw Skill Name: pywencaistock Version: 1.0.0 The skill bundle is classified as suspicious due to the inclusion of security vulnerabilities and irregular coding practices. Specifically, SKILL.md recommends disabling SSL certificate verification (ssl._create_unverified_context) as a troubleshooting step, which is a high-risk action that exposes the agent to man-in-the-middle attacks. Additionally, scripts/example.py contains a hardcoded path modification (sys.path.insert(0, '/tmp/mootdx')), which is an unusual practice that could be exploited in shared environments. While the core logic for fetching stock data via the pywencai library appears aligned with its stated purpose, these flaws introduce significant security risks.