Stock Portfolio

股票组合管理与预警技能。支持 A 股/港股/美股行情查询、持仓跟踪、收益计算、价格预警、每日推荐。使用免费 API（腾讯财经），数据本地存储。

This skill appears internally consistent for a local stock portfolio manager: it only calls public finance APIs and stores JSON files in its own data directory. Before installing/run: - Review the full code (you received some truncated file listings) to confirm there are no hidden network calls or unexpected behavior. Run it in a sandbox or VM first. - Note a code bug: data_sources.py (DataSourceManager) shows a likely typo/bug (assignment to undefined name 'source') — expect runtime errors; consider fixing or reviewing the module before use. - Cron examples assume /root paths and show piping output into openclaw message send; if you configure cron, ensure the target chat ID and message command are correct and trusted — otherwise alerts/reports could be sent to external recipients. - The skill uses unencrypted HTTP endpoints for some APIs (qt.gtimg.cn, hq.sinajs.cn, push2.eastmoney.com). That can be tampered with on insecure networks; consider switching to HTTPS-capable sources (Yahoo/official HTTPS endpoints) or run behind a trusted network. - Data privacy: holdings/alerts/history are stored locally under the skill workspace; back them up if important. The skill does not exfiltrate this data on its own, but any cron or notification configuration that sends data to third-party messaging channels will transmit it. If you want higher assurance, ask the author for a corrected/reviewed data_sources.py, or run a line-by-line audit and unit tests (especially network code) before making the skill autonomous.

Type: OpenClaw Skill Name: stock-portfolio Version: 1.0.0 The stock-portfolio skill is a legitimate tool for tracking stock prices and managing a personal portfolio using public, unauthenticated APIs from Tencent, Sina, and EastMoney. The Python scripts (stock_fetch.py, portfolio_manager.py, daily_picks.py) use standard libraries to fetch market data and store user holdings locally in JSON format. No evidence of data exfiltration, unauthorized network calls, or malicious prompt injection was found.