A-Share Review and Analyse

A-share market automated review and analysis system, generating daily market insights with Gemini AI, supporting publishing to Hugo blog and WeChat Official...

This skill generally does what it claims (fetch data, run Gemini analysis, publish to Hugo/WeChat), but there are a couple of important issues to consider before installing or running it: 1) Inspect and fix base_dir in scripts/config.py: it computes base_dir by going four parents up from scripts/config.py, which will likely place data/content directories outside the repository and may write files in unexpected locations. If you install/run, either run it in a controlled sandbox or change base_dir to the repository root (e.g., Path(__file__).parent.parent). 2) Environment loading: the skill auto-loads .env files from multiple locations (project root, skill root, ~/.openclaw/..., XDG config). load_dotenv(..., override=True) may override your system environment variables. Put sensitive keys (Gemini/WeChat) only in a project-scoped .env or pass them explicitly via CLI/CI, and avoid running this code on machines with unrelated secrets in user-level .env files. 3) Metadata mismatch: the registry metadata doesn't list GEMINI/WECHAT env vars even though the skill expects them. Treat GEMINI_API_KEY and WeChat AppID/Secret as required for those features. 4) Run check_env.py first in a safe environment to see what files and directories the skill will create, and consider running the skill inside a container or isolated VM until you're comfortable. 5) If you plan to use WeChat publishing, be aware the code will make network calls to api.weixin.qq.com and upload images/content; only provide WeChat credentials you trust with the tool. For sensitive/commercial data, consider using paid Gemini settings as noted in docs. If you want, I can show the exact lines in config.py and check_env.py to modify to point base_dir to the repository root, or generate a patch that limits .env loading to the project directory only.

Type: OpenClaw Skill Name: stock-review-ai Version: 1.0.1 The 'stock-review-ai' skill bundle is a legitimate automated A-share market analysis and reporting tool. It utilizes the 'akshare' library for financial data retrieval, Google Gemini for market sentiment analysis, and official APIs for publishing to Hugo blogs and WeChat Official Accounts. The code structure is transparent, following standard practices for configuration management (scripts/config.py) and logging (scripts/utils/logger.py). No indicators of malicious intent, such as unauthorized data exfiltration, credential theft, or hidden backdoors, were identified.