Stocki

AI financial analyst with institutional-grade data covering A-shares, HK stocks, US stocks, ETFs, and indices. Supports real-time quotes, sector/industry ana...

This skill appears internally consistent with its described purpose, but consider these practical safety steps before installing: - Only set STOCKI_API_KEY and STOCKI_GATEWAY_URL if you trust the Stocki service (https://api.stocki.com.cn). The API key grants access to your Stocki account—treat it like a password and prefer a key with limited scope if possible. - The skill will make outbound network requests (to your configured gateway and to raw.githubusercontent.com for version checks) and will create a local workspace (~/stocki/) and downloaded reports. If you run in a sensitive environment, consider installing in a sandbox or container. - The doctor can reinstall itself using clawhub/git and runs an rm -rf on the skill directory after a basic basename check; review the _reinstall_skill() logic if you are concerned about self-updating scripts. - Scheduled monitoring via cron is suggested in SKILL.md—cron jobs will cause periodic outbound queries. Only enable scheduling if you want automated polling. - If you need additional assurance, inspect the full scripts locally (already bundled) and run python3 scripts/stocki.py diagnose to verify behavior with a test API key. Overall: coherent and expected for a gateway-backed financial analysis CLI, but exercise standard caution around API keys, automatic updates, and scheduled tasks.

Type: OpenClaw Skill Name: stocki Version: 0.4.3 The Stocki skill bundle is a financial analysis tool designed to provide market data and quantitative analysis via a remote gateway. The code in `stocki.py` and `_gateway.py` uses standard Python libraries to interact with its API and includes a 'doctor' command for self-repair that can re-install the skill via Git or ClawHub. While the self-update mechanism and the management of a local workspace in `~/stocki/` involve high-privilege file system operations, they are aligned with the stated purpose of the tool, and the inclusion of path traversal checks in the `download` command suggests a non-malicious, security-conscious implementation.