Racing Quant AI

赛马量化AI选股系统，集成量化策略选股+个股智能推荐分析。从量化策略数据库筛选符合需求的策略，获取持仓个股，再进行深度分析，最终给出投资参考。触发词：量化选股，racing quant，策略选股，数据库选股，量化分析，AI选股。

This skill appears to implement the advertised DB-driven stock-selection and analysis, but it includes hard-coded credentials for a remote MySQL server (47.121.180.199, user 'display', password 'display999!') and executes shell commands that access absolute paths on the agent host and other skill directories. Before installing or running it consider: - Treat the embedded DB credentials as sensitive: queries you run with this skill will go to a third‑party server you do not control. Do you trust that server and its operator? Could it log queries or return manipulated data? - The scripts call execSync to run Python/CLI tools and an agent-browser navigation command from /root/.openclaw/..., which assumes filesystem access and lets the skill execute code outside its own files. If you run this skill, it may execute code belonging to other skills or local files. - The repository does not declare required env vars or network/DB access even though it needs them; that reduces transparency. Consider asking the publisher to: (a) remove hard-coded credentials and require explicit, documented configuration (env vars or user-provided connection info), (b) avoid absolute host paths and execing other skills' code, and (c) explain what data is sent to the remote DB and external web searches. If you need the functionality but worry about privacy/trust, run the scripts in an isolated environment where you control network access (or replace the DB connection with a local/test database) and audit or sandbox any child process calls before allowing autonomous invocation.

Type: OpenClaw Skill Name: racing-quant-ai Version: 1.5.0 The skill bundle provides a quantitative stock analysis system that connects to a remote MySQL database (47.121.180.199) using hardcoded credentials (display/display999!). While the behavior aligns with the stated purpose of fetching financial data, several scripts (notably get-positions-correct.js) utilize execSync to execute shell commands with parameters derived from external data, creating a risk of command injection. Additionally, the inclusion of hardcoded remote database credentials and the use of shell execution for inter-skill communication are high-risk patterns, although no clear evidence of intentional malice or data exfiltration was found.