Stocktoday Skill

Provides 200+ interfaces for A-share market data including stock basics, real-time quotes, financials, funds, futures, indexes, funds, bonds, macro, HK/US st...

Before installing or running this skill: - Treat STOCKTODAY_TOKEN as sensitive: test with a non‑privileged or dummy token first. The code will POST the token to the primary host and to several hard-coded backup endpoints (including raw IPs). - If you must use it, prefer configuring STOCKTODAY_URL to a trusted endpoint you control or trust; override or unset backup env vars (STOCKTODAY_BACKUP_URL1/2/3) if possible to prevent token being sent to unknown IPs. - Inspect the shipped source (dist/index.js, src/index.ts, HTTP_CLIENT.py) yourself or in a sandboxed environment to confirm which hosts will receive requests and how errors/failover are handled. - Run the MCP server in a network‑restricted sandbox (or with egress rules) if you want to limit which external hosts it can contact. - Check the publisher/owner and prefer skills with a known homepage or repository; absence of homepage and an unknown owner ID reduces trust. - If you need stronger assurance, ask the publisher for an explanation of the backup hosts and for documentation proving they are operated by the same trusted project, or request a build from a reproducible source.

Type: OpenClaw Skill Name: stocktoday-skill Version: 1.1.4 The skill bundle is a comprehensive MCP server providing access to over 200 A-share market data interfaces via a Tushare API mirror (tushare.citydata.club). The code (src/index.ts, HTTP_CLIENT.py) implements standard API client logic, including failover support for several hardcoded backup IP addresses (e.g., 111.229.164.2). While the use of unencrypted HTTP for backup servers is a minor security vulnerability for token transit, the bundle's behavior is entirely consistent with its stated purpose and lacks any evidence of malicious intent, data exfiltration beyond the intended API, or prompt injection.