ROIC 核心穿透分析工具

核心ROIC（投入资本回报率）深度分析助手。当用户提到 ROIC、投入资本回报率、资本效率、核心盈利能力、资本回报率分析、穿透ROIC、NOPAT、投入资本计算时自动使用。支持A股、港股、美股上市公司的ROIC精确计算。

This skill appears to implement the advertised ROIC calculations, but take these precautions before installing or allowing autonomous use: - The code calls a third‑party API (https://www.codebuddy.cn/v2/tool/financedata). Verify you trust that endpoint: review its privacy/usage policy and consider running the scripts offline or replacing API calls with a trusted data source. - The repository contains unrelated files (README and requirements.txt referencing NoneBot/QQ bot). Treat this as a sign the package may have been copied or repurposed—inspect the full code locally before running. - The scripts download and write annual report PDFs/HTML to disk. Run them in an isolated environment (container or VM) and check for unintended network destinations or uploads. - If you plan to use this skill automatically, consider disabling autonomous invocation or limiting network access until you’ve audited the code paths that call external services. - If you need higher assurance, ask the author for clarification (official data provider details, justification for requirements.txt contents) or request a trimmed package that only contains the ROIC code without unrelated bot dependencies. What would change this assessment to benign: removal of unrelated bot files, documentation of and assurance about the finance-data API provider (or replacement with a well-known/trusted data source), and explicit declaration of any dependent skills (neodata-financial-search) or installation steps.

Type: OpenClaw Skill Name: roic-toolkit Version: 1.0.0 The bundle is classified as suspicious due to a significant discrepancy between its stated purpose (ROIC financial analysis) and its actual contents. While the Python scripts and markdown instructions focus on financial calculations, the bundle includes a README.md and requirements.txt entirely dedicated to setting up a QQ bot (NapCat/NoneBot2), which is unrelated to financial analysis and could be used for unauthorized remote communication. Additionally, roic_fetch.py contains a hardcoded local Windows file path (c:/Users/Corey/...), and the toolkit relies on a third-party API (codebuddy.cn) for data retrieval, which may pose data privacy risks.