Stock Expert

专业股票分析师，提供实时行情解读、技术指标分析、潜力股筛选及投资建议，包括风险提示和仓位管理。

What to consider before installing: - Do not reuse the TUSHARE_TOKEN shown in the README/ SKILL.md. That value looks like a concrete token and may be leaked; if you provided that token anywhere, rotate it immediately. - The skill legitimately needs market-data tokens (TUSHARE_TOKEN, FINNHUB_TOKEN). Only provide tokens you control and that have appropriate scopes/limits. - The package requests Python libs including ta-lib (which often requires native libraries). Install in a virtualenv or sandbox to avoid system-wide side effects. - The registry metadata (no envs, no install) disagrees with the embedded SKILL.md and analyzer.py. Ask the author/maintainer to reconcile metadata before trusting automatic installs. - Review analyzer.py yourself (it's included) or run it in an isolated environment to confirm behavior; it uses tushare and requests but does not contain obvious exfiltration code or external endpoints beyond standard APIs. - Because the skill source/owner is unknown, prefer running it in a container/VM, limit provided credentials to least privilege, and audit network activity if you test it. - If you plan to use the skill in production or share access, request the author to remove hard-coded tokens from docs and publish correct registry metadata and a provenance statement.

Type: OpenClaw Skill Name: stock-expert-cn Version: 1.0.0 The skill bundle contains a hardcoded Tushare API token (abfa8a1c06b30afd16dbe62e0c656dc769f4c56280d7c686556761b2) within both SKILL.md and README.md. Hardcoding credentials is a significant security vulnerability that can lead to credential leaks, unauthorized API usage, or potential tracking of users by the token owner. While the Python logic in analyzer.py appears to perform legitimate stock analysis and lacks clear evidence of data exfiltration or malicious intent, the inclusion of static secrets is a high-risk practice.