股票列表自动管理

从图片自动识别股票并加入股票池。触发条件：用户发送股票截图/图片并要求加入股票池。功能：(1) 使用RapidOCR识别图片中的股票代码、名称、涨幅、价格 (2) 自动去重 (3) FIFO原则管理30只股票上限 (4) 保存到manual_stock_list.json。

What to check before installing: - Confirm the hard-coded paths are intended: both scripts use /Users/wy/.openclaw/… which is a specific user directory. If your environment uses a different user or a container, the skill may fail or overwrite files unexpectedly. Ask the author to make the media and workspace paths configurable. - Ensure dependencies (rapidocr_onnxruntime and OpenCV / python-opencv) are available in your runtime. The package/dependency installation is not declared; the skill will fail without them. - Review the files the skill writes to (manual_stock_list.json) and back them up if needed. Test in a sandbox or with dummy files first. - Confirm privacy expectations: the skill will read inbound images and persist recognized stock codes and names locally. If inbound images contain other sensitive content, be aware it will be processed. - If you want to reduce risk, request the author to: (1) replace absolute paths with configurable environment variables or relative workspace paths, (2) add an install spec or dependency list, and (3) include explicit error handling/logging and a dry-run mode. If these changes are made, re-evaluate; as-is the issues look like sloppy engineering rather than overt malicious behavior, but they warrant caution.

Type: OpenClaw Skill Name: quant-stock-list Version: 1.0.0 The skill contains hardcoded absolute file paths pointing to a specific user's home directory (/Users/wy/) in both scripts/add_stocks.py and scripts/update_stock_list.py. While the logic for OCR and stock list management aligns with the stated purpose, the use of fixed, non-portable paths is a significant security flaw and suggests the code was either poorly adapted from a local environment or designed to interact with a specific user's filesystem.