← 返回 Skills 市场
99
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install shi-shi-cai-jing
功能描述
实时抓取并汇总新浪财经7×24小时全球财经新闻。通过API接口智能增量检测,每5分钟自动抓取最新新闻。
安全使用建议
This skill mostly matches its description (periodically fetching and storing news via the Sina API), but there are three things you should consider before installing:
1) Unused/undeclared browser scraper: The repo includes fetch_and_save.js which uses puppeteer.connect to http://localhost:9222 and will read DOM from open browser pages (fallback to pages[0]). If you do not want any code reading your open browser tabs, do not run that script. Prefer using fetch_api.js (API-only) if you only need API pulls.
2) Missing dependency and install info: The metadata does not declare Node/npm or puppeteer requirements. If you plan to run the code, run it in a sandbox or container, and install dependencies explicitly (npm install puppeteer) after auditing them. Consider running only fetch_api.js (it uses only built-in https) to avoid installing puppeteer.
3) Unexpected characters and data: SKILL.md contains unicode control characters (prompt-injection signal) — view the file in a hex/clean text editor and remove suspicious invisible characters. The skill includes a large news_db.json sample; verify it contains only benign news before using or sharing it.
Recommended actions: inspect and optionally remove fetch_and_save.js if you don't need browser scraping; run fetch_api.js in a dedicated environment; review and sanitize SKILL.md for control characters; and only add the cron job for the script you trust. If you are uncertain, run the skill in an isolated VM/container and monitor network and filesystem activity.
功能分析
Type: OpenClaw Skill
Name: shi-shi-cai-jing
Version: 1.0.0
The skill bundle is designed to fetch and aggregate real-time financial news from Sina Finance using both web scraping (via Puppeteer in fetch_and_save.js) and a public API (in fetch_api.js). It includes robust logic for incremental updates, data persistence in local JSON files, and automated cleanup of records older than seven days. No evidence of data exfiltration, malicious execution, or prompt injection was found; the code and instructions align perfectly with the stated purpose of tracking global financial news.
能力评估
Purpose & Capability
The description promises API-driven incremental fetches every 5 minutes (and SKILL.md emphasizes using fetch_api.js, no browser required), but the repository also includes fetch_and_save.js which uses puppeteer and connects to a local browser debugging endpoint (http://localhost:9222). That file is not mentioned as a requirement (no required binaries, no declared dependency on puppeteer or a running Chrome/Chromium). The presence of a browser-based scraper is disproportionate to the stated 'API-only' purpose and is an undeclared capability.
Instruction Scope
SKILL.md instructs running node fetch_api.js and scheduling a cron, which is fine, but also the codebase contains fetch_and_save.js that will connect to a local browser and evaluate page DOM. That script falls back to pages[0] if it cannot find a finance page, meaning it may read content from arbitrary open tabs. The SKILL.md contains a detected 'unicode-control-chars' injection signal, which could be an attempt to manipulate prompt/evaluation flows. Overall the runtime instructions and included code allow reading broad local browser state not disclosed in the description.
Install Mechanism
There is no install spec; this is instruction-only, but the code requires Node and (implicitly) npm modules. fetch_api.js only uses built-in https, but fetch_and_save.js requires the puppeteer package and a running browser with remote debugging. Those dependencies are not declared or installed automatically, creating a mismatch and potential surprise for users. No remote downloads or odd URLs are present.
Credentials
The skill requests no environment variables or external credentials (which is appropriate). However, the puppeteer script requires access to a local browser debugging endpoint (localhost:9222) and will read page content from the browser; that is an implicit environment/resource access not declared in the metadata. No network exfiltration endpoints beyond the Sina API (https://app.cj.sina.com.cn) are present in the code.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and only writes data under its own workspace (data/news_db.json, state files). It suggests a cron job but does not force permanent installation or elevated privileges.
如何使用
- 确保已安装 OpenClaw(本地或 Docker 部署)
- 在对话框中输入安装命令:
/install shi-shi-cai-jing - 安装完成后,直接呼叫该 Skill 的名称或使用
/shi-shi-cai-jing触发 - 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.0
初始版本
元数据
常见问题
实时财经 是什么?
实时抓取并汇总新浪财经7×24小时全球财经新闻。通过API接口智能增量检测,每5分钟自动抓取最新新闻。 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 99 次。
如何安装 实时财经?
在 OpenClaw 或 Claude Code 对话框中运行命令「/install shi-shi-cai-jing」即可一键安装,无需额外配置。
实时财经 是免费的吗?
是的,实时财经 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。
实时财经 支持哪些平台?
实时财经 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。
谁开发了 实时财经?
由 ripplefox(@ripplefox)开发并维护,当前版本 v1.0.0。
推荐 Skills