Daily Stock Announcement

每日股票投资组合公告工具，集成Gmail邮件报告和Sonos语音播报功能。

This skill appears to implement the advertised Gmail + Sonos features, but exercise caution before installing. Specific concerns: (1) The registry metadata omits required env vars even though the script expects SONOS_SPEAKER and RECIPIENT_EMAIL and a Gmail OAuth token; (2) the script actively searches for credentials in multiple fallback locations (workspace .env, current working directory, your home directory, /config), which could cause it to pick up and use unrelated Gmail tokens on your machine; (3) there are packaging/path mismatches in SKILL.md/skill.yaml (references to scripts/ path that don't match the included filename), indicating sloppy packaging. Recommended actions before installing or running: review the full script yourself (especially the credential-loading code), put Gmail token only in the intended config location (or better: use a dedicated service account or project-limited token), run the skill in an isolated environment or container, set RECIPIENT_EMAIL to a safe test address first, and verify you trust the sonoscli GitHub repository used for the 'sonos' binary. If you require higher assurance, ask the author to remove fallback scanning of home and root paths and to declare required env vars in the metadata.

Type: OpenClaw Skill Name: stock-announcement Version: 1.1.0 The stock-announcement skill is a legitimate automation tool for portfolio tracking. It uses standard libraries like yfinance for data and the official Google API client for Gmail integration. The code follows security best practices, such as using subprocess.run with argument lists to prevent shell injection and implementing structured logging and retry logic. No evidence of data exfiltration, credential theft, or malicious instructions was found in daily_stock_announcement.py or the documentation.