Smc Trading Signal

SMC 聪明钱交易信号监控，1H 定方向 +15M 入场，ATR 动态止盈止损。支持黄金/加密货币/外汇。

Things to check before installing: - Ask the maintainer why the skill metadata lists a required binary named 'uv' — it's not referenced by the scripts and may be a metadata mistake. - Inspect monitor_v2.py fully (it is executed via exec in monitor.py). Exec-ing a local file runs arbitrary code from the skill directory; confirm its contents are acceptable and review for hidden actions. - Note the scripts call external endpoints (hq.sinajs.cn and Yahoo). The Sina request disables TLS verification (verify=False), which can make network traffic vulnerable to interception—consider running only on a trusted network or patching the request to enable certificate verification. - The skill doesn't require secrets, but it performs network I/O and writes output files under the skill workspace. Run it first in a sandbox or isolated environment, and create a Python virtualenv with explicit pip installs (requests, akshare if you need it) rather than relying on system packages. - The SKILL.md and README point to a GitHub repo; review that repository and recent commits for further context and verify the maintainer identity before trusting signals for live trading. - Because the skill is not marked for automatic trading, it will only produce signals — do not provide any trading API keys unless you explicitly add and audit code to support safe automated execution.

Type: OpenClaw Skill Name: smc-trading-signal-cn Version: 1.0.1 The skill bundle is classified as suspicious due to high-risk coding practices that introduce significant security vulnerabilities. Specifically, `scripts/monitor.py` uses `exec()` to dynamically execute the contents of `scripts/monitor_v2.py`, a pattern that facilitates arbitrary code execution if the bundle's files are tampered with. Additionally, `scripts/monitor_v2.py` performs network requests to Sina Finance (`hq.sinajs.cn`) with SSL verification explicitly disabled (`verify=False`), exposing the agent to Man-in-the-Middle (MITM) attacks. While these behaviors appear to be unintentional security flaws rather than deliberate malware, they represent a high-risk attack surface.