trading-monitor

盘中股票盯盘定时任务管理。创建、配置和管理A股交易时段的自动分析任务，包括定时行情播报、深度分析、收盘前最终分析。使用场景：设置盯盘、调整分析频率、查看任务状态、停止/启动任务。触发词：盯盘、设置分析、开盘监控、调整频率、盯盘任务。

This skill's goal (automated intraday stock analysis) is reasonable, but there are gaps and risky suggestions you should resolve before installing. Specifically: 1) The SKILL.md references deployment and management scripts (scripts\setup.ps1, scripts\manage.ps1) that are not included — ask the publisher where these come from and inspect them before running. 2) The skill suggests changing the gateway exec policy to 'full' — avoid relaxing global exec allowlists unless you have audited the scripts and understand the implications. 3) The skill expects to push messages to channels like Feishu but does not declare required API tokens or how secrets are stored; confirm which credentials are needed and grant the minimum scope. 4) Treat any one‑click deployment script obtained from an external source as untrusted until reviewed; run in a sandbox or staging environment first. If you cannot obtain the missing scripts or a trustworthy source, do not enable the cron tasks or change exec security.

Type: OpenClaw Skill Name: trading-monitor Version: 1.2.0 The skill bundle facilitates a stock trading monitor but contains instructions in SKILL.md and references/config-guide.md that direct the user to disable security restrictions by setting 'tools.exec.security' to 'full'. It also relies on external PowerShell scripts (scripts/setup.ps1 and scripts/manage.ps1) that are not provided in the file list but are executed with 'ExecutionPolicy Bypass', creating a significant risk for arbitrary code execution. While the stated purpose is benign, the explicit encouragement to lower the environment's security posture is a major red flag.