同花顺 iFinD 接入 Skill

Use when the user needs Tonghuashun iFinD market, report, factor, screening, calendar, or other financial data, and all data must come from iFinD after succe...

This skill appears to do what it says: a local Python CLI/skill that exchanges an iFinD refresh_token for an access_token and routes natural-language queries to the iFinD API (quantapi.51ifind.com). Before installing or giving tokens: 1) Only provide the iFinD refresh_token if you trust the skill/operator — the refresh_token grants access to your iFinD account and is stored locally in the skill's token_state.json. 2) Do NOT share your iFinD username/password; the skill explicitly asks for refresh_token only. 3) If you enable the optional LLM routing (IFIND_ROUTE_LLM_ENABLED and IFIND_ROUTE_LLM_API_KEY), be aware user queries (or routing plans) will be sent to the configured LLM provider — this may leak sensitive query content. 4) Inspect scripts/install_skill.sh locally before running it and confirm installation path (~/.openclaw/workspace/skills/tonghuashun-ifind-skill). 5) If you need stronger isolation, run the skill in a restricted environment or use an account whose tokens you can revoke. Overall the package is internally coherent with its stated purpose; the primary risk is the sensitive refresh_token and any optional LLM usage, not malicious mismatches.

Type: OpenClaw Skill Name: tonghuashun-ifind Version: 0.5.1 The skill bundle provides a natural language interface for the Tonghuashun iFinD financial data API. It implements a structured CLI (`ifind_cli.py`) that handles authentication by exchanging user-provided refresh tokens for access tokens, which are stored locally in the user's home directory. The logic includes both local rule-based routing and an optional LLM-based router (`llm_routing.py`) to map natural language queries to specific API endpoints. The instructions in `SKILL.md` and `openai.yaml` are security-conscious, explicitly directing the agent not to request passwords and to avoid echoing sensitive tokens back to the user. No evidence of malicious behavior, such as unauthorized data exfiltration or hidden command execution, was found.