Stock Market Analyzer

A-share stock market analysis tool with real-time price data, technical indicators, trend analysis, and portfolio tracking. Supports querying opening/closing...

This package largely does what it claims, but it relies on an undocumented external module 'kimi_finance' whose source and behavior are not provided. Before installing or running this skill: (1) verify where 'kimi_finance' comes from (PyPI project page, source repo, or vendor) and review its source or documentation; (2) avoid running it on machines with sensitive data until you confirm the dependency is safe; (3) if you plan to install, add an explicit install spec or update requirements to include 'kimi_finance' with a specific version and origin; (4) run the code in a sandbox or container and monitor network traffic to see which endpoints it contacts; (5) prefer skills with a clear homepage, source repo, and declared dependencies. If you can provide the 'kimi_finance' package source or more provenance, I can re-evaluate and likely raise confidence.

Type: OpenClaw Skill Name: stock-market-analyzer Version: 1.0.0 The script `scripts/stock_analyzer.py` contains a potential arbitrary file read vulnerability because several functions (e.g., `query_realtime_price`) accept a user-controlled `file_path` argument that is passed directly to `pandas.read_csv()` without validation. This could allow an attacker to exfiltrate sensitive system files if they can influence the function arguments via prompt injection. Additionally, the code relies on an external module `kimi_finance` that is not declared in the `requirements.txt` file, which is a discrepancy in the bundle's dependency management.