Temp Skill

提供基于免费数据源的多资产投资组合分析，支持滚动窗口风险平价调仓及完整回测和图表报告生成。

Do not run this skill blindly. Key concerns: (1) The documentation promises live API fetching and asks for an ALPHA_VANTAGE_API_KEY, but the included code shown works only with local CSVs — verify whether any hidden/remaining code does network calls before providing API keys. (2) The manifests/docs disagree about dependencies (yfinance/plotly appear in README/SKILL.md but not in manifest); install only the packages you need and inspect imports. (3) Review the full optimized_risk_parity_skill.py and optimized_main.py for any network, subprocess, or filesystem writes (the provided excerpt is truncated and contains an apparent unfinished return referencing an undefined variable). Run the code in a sandboxed environment with non-sensitive sample CSVs first, and consider static inspection or running with tracing to detect unexpected outbound connections. If you intend to use live APIs, only supply API keys after confirming exactly which module will use them and where keys are read from.

Type: OpenClaw Skill Name: temp-skill Version: 1.0.0 The skill is classified as suspicious due to potential Local File Inclusion (LFI) and arbitrary file write vulnerabilities. The `optimized_main.py` script accepts arbitrary file paths for `--csv` input and `--output` directory, which are then used by `optimized_risk_parity_skill.py` for reading and writing files. An AI agent could be prompted to supply paths to sensitive system files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`) for reading, or to sensitive directories for writing, potentially leading to information disclosure or denial of service. There is no evidence of intentional malicious behavior, data exfiltration, or prompt injection attempts within the markdown files; the identified risks are vulnerabilities in argument handling.