Stock Push

A股股票定时推送系统。管理盘前推荐（09:20）、收盘复盘（15:05）、次日关注（20:00）三个推送任务，每交易日晚自动发送持仓股行情到微信。当用户提到：股票推送、持仓监控、定时提醒、A股行情，或者需要查询持仓盈亏、复盘信息、次日建议时触发。also triggers when user says "推送"...

Do not run the installer or scripts without inspection. Before installing: (1) Open scripts/stock_pre.py, stock_after.py, stock_next.py and change USER_ID to your own WeChat ID (or set it to empty and make the scripts fail-fast). Search the repo for 'USER_ID' and verify no other hardcoded recipients exist. (2) Review HOLDINGS/WATCH_LIST and confirm they contain only your intended tickers — the scripts will send those values off‑device. (3) Avoid piping unknown URLs to bash; download the .skill bundle, inspect it, and extract locally. (4) Be aware install scripts write /etc/cron.d and /etc/logrotate.d as root — if you prefer less privilege, run the Python scripts under a user cron or run them manually. (5) Verify the openclaw message send behavior in a controlled test (use a test USER_ID) so you know where messages go. If you cannot inspect or safely change USER_ID, do not install — leaving the default could send your holdings to a third party.

Type: OpenClaw Skill Name: stock-push Version: 1.0.2 The skill bundle requires root privileges to install system-level persistence (cron jobs in /etc/cron.d) and log rotation configurations, which is a high-risk operation for an AgentSkill. Additionally, all execution scripts (stock_pre.py, stock_after.py, stock_next.py) contain a hardcoded WeChat USER_ID ('[email protected]'), meaning a user's stock holdings and market data would be sent to the author by default if not manually updated. The installation scripts also employ the 'curl|bash' pattern and use os.system for command execution, increasing the attack surface.