对上市公司进行系统性投资价值分析，支持 A 股、港股、美股

对上市公司进行系统性投资价值分析，支持 A 股、港股、美股

This skill appears to do what it says: fetch public market data, compute indicators, and produce downloadable HTML reports. Before installing or running it: 1) Run it in an isolated container or environment (do not bind the container port to a public host) because it launches a simple Python HTTP server on port 8888 that will expose the reports directory to the network if reachable. 2) Treat user-supplied inputs (company name / stock code) as untrusted: filenames are constructed without sanitization, which could allow path traversal or overwriting files — prefer safe names or validate/escape inputs. 3) Ensure the runtime has only expected tools (curl, jq, bc, python3) and that outbound network access is acceptable (the scripts call multiple public finance sites over HTTP/HTTPS). 4) If you need stricter privacy, modify generate-pdf-report.sh to bind the HTTP server to localhost only (python3 -m http.server --bind 127.0.0.1) or avoid starting a server and instead use the platform's file-download API. If you want me to, I can point out exact lines to harden (e.g., sanitize COMPANY_NAME, restrict server bind) or produce a patched generate-pdf-report.sh that is safer.

Type: OpenClaw Skill Name: stock-analysis-best Version: 1.4.0 The skill bundle implements a high-risk feature by starting a background HTTP server on port 8888 using 'python3 -m http.server' in 'generate-pdf-report.sh' to serve generated reports. While this aligns with the stated purpose of providing downloadable reports, it opens an unauthenticated network port within the environment. Additionally, multiple scripts (e.g., 'analyze.sh', 'generate-pdf-report.sh', and 'fetch-research.sh') are highly vulnerable to shell command injection because they use unsanitized user inputs like stock codes and company names directly in shell commands and curl arguments. There is no evidence of intentional data exfiltration, but the combination of network exposure and critical injection vulnerabilities warrants a suspicious classification.