Stock Data Monorepo

A 股数据查询技能集合，包含 4 个子技能：cn-stock-volume（成交量）、stock-top-gainers（涨幅排名）、ths-stock-themes（题材概念）、stock-theme-events（题材事件）。 **触发场景**: - 作为 stock-daily-report 的数据源依赖...

What to check before installing or running this skill: - Review and run the scripts in a sandboxed environment (not on a production host). The code uses subprocess to call 'openclaw', 'npx', and 'node' — confirm those binaries exist and are trustworthy in your environment. - Inspect any subprocess invocations that interpolate strings (the code uses python -c and builds command strings in places). If you will pass untrusted input to the scripts, this can be a command-injection risk. - Note the scripts read/write files under your home directory (workspace, ~/.jvs/.openclaw, ~/Desktop, manual/). If you are uncomfortable with that, run from a separate user or container and change output paths. - The code attempts to read another skill's cache at a hardcoded path; verify you are okay with cross-skill file reads and that no sensitive data exists at that path. - Dependencies: SKILL.md lists pip packages (akshare, sentence-transformers, scikit-learn). Ensure you install them in an isolated virtualenv to avoid dependency conflicts. - If you plan to allow autonomous agent invocation, be cautious: the scripts try to call platform tooling to access a 'browser' tool. If the platform CLI were compromised, this skill could trigger broader actions — consider keeping autonomous invocation disabled until you vet the toolchain. If you want, I can highlight exact lines of concern (subprocess calls, hardcoded cache paths, file-write locations) so you or a developer can inspect them before running.

Type: OpenClaw Skill Name: stock-data-monorepo Version: 1.2.5 The skill bundle contains several security vulnerabilities and poor development practices that pose a risk to the host environment. Specifically, 'cn-stock-volume/scripts/fetch_data.py' exhibits a potential code injection vulnerability where a URL is unsafely interpolated into a Python command string executed via 'subprocess.run'. Additionally, multiple scripts, including 'generate_report.py' and 'run_full_analysis.py', use hardcoded absolute paths tied to a specific user environment ('/Users/shinelp100/...') and write files directly to the user's Desktop ('~/Desktop/A 股每日复盘'). While these behaviors appear to be unintentional flaws or developer oversights rather than intentional malware, the combination of intrusive file system access and unsafe command execution warrants a suspicious classification.