stock-assistant

A股交易辅助工具，集行情查询、交易记录管理、盈亏分析于一体。 用于：(1) 查询A股实时行情 (2) 管理交易记录 (3) 计算持仓和盈亏 (4) 导入/导出CSV 代码目录：D:\aicode\stock-assistant（跨平台：代码会自动适配路径） 调用方式：from fetcher import get...

This skill appears to do what it claims: fetch A‑share quotes, manage/import/export trades, compute P&L, and optionally push to Feishu. Before installing/running: 1) Review and install the Python dependency (requests). 2) Be aware the tool writes a local SQLite DB (data/trades.db) in the project folder — run it in a directory you control. 3) If you use the Feishu features, provide webhook/app credentials only to trusted recipients; the tool will POST data you choose to send. 4) CSV note: sample and import files contain cells starting with '='; exported CSVs may be interpreted as formulas by Excel — consider sanitizing leading '=' if you open CSVs in spreadsheet programs to avoid CSV/Excel injection. 5) If you need higher assurance, inspect the fetcher module (it calls Tencent/EastMoney/Sina endpoints) to confirm acceptable endpoints and behaviour.

Type: OpenClaw Skill Name: stock-assistant Version: 1.2.0 The skill bundle provides a functional A-share stock assistant, but it is classified as suspicious due to its high-risk capabilities, including network access to multiple external financial APIs and Feishu notification endpoints (fetcher.py), and local file system access for database and CSV management (db.py, trader.py). While these features are aligned with the stated purpose, the 'notify' command in main.py allows sending data to arbitrary external webhooks, and the CSV import functionality in trader.py lacks path sanitization, which could be exploited for unauthorized file access or data exfiltration if the agent is misdirected.