同花顺Level2数据接入

同花顺Level2数据获取与深度分析工具。支持读取同花顺远航版本地数据、 分析股票行情、获取实时Level2数据、生成技术分析报告。 用于：(1) 获取持仓股票实时数据 (2) Level2资金流向分析 (3) 个股深度分析 (4) 生成投资策略报告

Key points before you install or run this skill: - Source provenance: the skill's registry entry has no homepage and the SKILL.md references a placeholder git URL; only proceed if you can verify the upstream repository and its author. Do not run untrusted code from unknown origins. - High‑privilege operations: several scripts attempt to read the local 同花顺 client files, parse DataPushJob.xml, perform TCP stream capture and even read process memory. These require administrator privileges and access to local network streams — only enable/run such features in an isolated environment (VM) and with explicit consent and understanding of legal/ToS implications. - Secrets: the code reads TUSHARE_TOKEN from the environment. If you provide your Tushare token, treat it as sensitive and avoid giving it to untrusted code. Consider using a limited/scoped token or a throwaway account for testing. - Review code: because installation is manual (copying the repo), open and inspect ths_memory_reader.py, analyze_protocol.py, ths_client.py, and any networking code before running. Look for any hardcoded remote endpoints, unexpected transmissions, or obfuscated code (none obvious in the provided files, but always verify). - Run minimal features first: to reduce risk, start with read-only analysis scripts that operate on sample or exported JSON data (ths_local_analysis.py, complete_technical_analysis.py) rather than the memory- or network-capture scripts. - Test in sandbox: run the repo in a disposable environment (VM or container) and with a non‑privileged user to confirm behavior before granting admin rights or pointing it at your real 同花顺 installation. - Legal/compliance: the SKILL.md warns that Level2 is a paid service — ensure you have rights to access and process this data and that intercepting the client/server traffic does not violate terms of service or laws in your jurisdiction. If you want, I can: (1) list the specific files that perform memory or network capture so you can inspect them first; (2) highlight places that would attempt outbound network connections; or (3) suggest a safe testing checklist/commands to run in a VM.

Type: OpenClaw Skill Name: ths-level2 Version: 1.0.0 The skill bundle contains high-risk capabilities including process memory scanning and reading via Windows APIs (ReadProcessMemory, VirtualQueryEx) in 'ths_memory_reader.py' and 'memory_scan_600276.py', as well as raw TCP socket communication with external servers in 'ths_client.py'. While these behaviors are consistent with the stated goal of extracting 'Level 2' stock data from a local Tonghuashun trading terminal, they require administrative privileges and represent significant security risks if repurposed. Additionally, 'analyze_protocol.py' discusses man-in-the-middle (MITM) techniques for protocol analysis. No clear evidence of intentional malice or data exfiltration was found, but the broad system access makes it suspicious.