Stock Prediction

自动化股票预测工作流。当用户发送包含股票代码的图片，并提及"预测"、"未来x天"、"采样次数"等关键词时触发。包含：图片中股票代码提取、预测环境检查与自启动、模型版本校验与切换、批量预测脚本执行、结果回传。

This skill will run local commands (conda activate, python main.py, batch_predict.py), start processes, call localhost:8000, and read/write files under C:\Users\Administrator\Desktop\kronos. Before installing or running it: 1) Verify where image OCR/stock-code-extraction is implemented (the provided scripts don't do OCR); 2) Inspect the backend code (main.py, batch_predict.py) that the skill will start — those files are not included here and could perform arbitrary actions; 3) Do not run on a production or sensitive host — test inside an isolated VM or sandbox first; 4) Update hardcoded paths and conda environment names to point to a non-privileged, known directory or use a dedicated user; 5) Ensure you trust the source (no homepage/unknown owner) and consider firewalling localhost:8000 or monitoring outbound connections while testing. The package is coherent for a local workflow but missing components and hardcoded assumptions make it risky without further review.

Type: OpenClaw Skill Name: stock-prediction Version: 1.0.0 The skill bundle is classified as suspicious primarily due to the high risk of command injection in scripts/run_prediction.py and scripts/health_check.py, which use subprocess.run and subprocess.Popen to execute PowerShell commands constructed via string formatting with user-influenced variables. Additionally, the skill relies on hardcoded absolute paths to the 'Administrator' desktop (C:\Users\Administrator\Desktop\kronos), which is a poor security practice and suggests a highly privileged or specific environment requirement. While the logic appears consistent with its stated purpose of stock prediction, the lack of input sanitization and the use of shell execution make it vulnerable to exploitation.