Trading Quant

量化交易数据分析工具。A股/美股/港股/贵金属实时行情，多维度评分(技术面+资金面+基本面)，涨跌停池，北向资金，分钟级资金流。Use when: (1) 查询任何股票实时行情和评分, (2) 分析A股涨跌停异动, (3) 查看北向资金流向, (4) 美股港股贵金属行情, (5) 全球市场概览, (6) 个股资金...

This skill is plausible for market analysis, but inspect and sandbox it before trusting it with real data. Specific things to check or do before installing: - Review scripts/lib/analysis/industry_classifier.py: it attempts to read a 'knowledge/watchlist.json' via a relative path outside the skill. If you keep any sensitive data in your agent workspace or knowledge directories, this could be read. Consider removing or sandboxing that behavior. - The code will create cache files (e.g., /tmp/quant_industry_cache.json) and use your home HuggingFace cache; expect large model downloads (FinBERT) if transformers isn't already cached. - No credentials are requested, but the skill will make network requests to public market APIs (Tencent, Sina, EastMoney, yfinance, HuggingFace). If you need to limit network or data exfiltration, run it in a restricted container/environment. - Confirm Python version and dependencies (SKILL.md uses python3.12; requirements.txt lists Python 3.10+). Install dependencies in a virtualenv before running. - If you plan to use this in an automated/always-on agent, remove or control any code that reads external files (watchlist path) or write caches to sensitive locations. Ask the publisher to justify the watchlist prefill and to document network endpoints and file I/O. If you can, run the tool in an isolated environment (container/VM) first and audit network calls (e.g., with a firewall or proxy) and file reads to ensure it only accesses intended resources.

Type: OpenClaw Skill Name: trading-quant Version: 1.0.0 The skill is classified as suspicious due to its extensive reliance on numerous third-party Python libraries (e.g., `akshare`, `yfinance`, `pytdx`, `baostock`, `transformers`) and frequent network calls to various external financial data APIs. While these actions are for the stated purpose of financial data analysis, they introduce a significant supply chain risk and a broad attack surface. Specifically, the `transformers` library downloads large ML models from HuggingFace, and `pytdx` connects to a hardcoded external IP address (`119.147.212.81:7709`). Additionally, the skill uses `/tmp` for IPC sockets and temporary caches (`/tmp/trading_quant_persistent.sock`, `/tmp/quant_industry_cache.json`), and modifies `sys.path` to load internal modules, which, while common for local service management and modularity, could present local attack vectors in a less secure environment. No explicit malicious intent (e.g., data exfiltration to unknown domains, persistence mechanisms, or prompt injection attempts) was found in the code or documentation.