tradingagents-cn-skill

股票多智能体分析报告生成。通过 6 个分析师串行分析 + 多空辩论 + 交易计划 + 风险评估， 生成专业 PDF 报告。触发场景：用户要求分析股票、生成股票报告、提供截图或代码进行分析、 询问买卖建议、要求技术分析或基本面分析或风险评估。

This skill appears to do what it says: coordinate LLM analyses, validate outputs, and render a PDF. Before installing, note two practical inconsistencies: (1) the Python scripts import a third‑party 'markdown' module (and possibly others) but the skill metadata doesn't declare pip dependencies — you may need to install them manually in the runtime environment; (2) the validator uses an environment variable TRADINGAGENTS_LOG_FILE to set the log path (SKILL.md instructs a safe default), but the script will honor any value of that env var — if an attacker or misconfiguration sets it to an unexpected path, logs could be written outside the skill directory. These are not direct evidence of malicious intent, but they are configuration and supply‑chain gaps you should address (install required Python packages in a controlled environment and ensure TRADINGAGENTS_LOG_FILE is set to a safe path) before using the skill.

Type: OpenClaw Skill Name: tradingagents-cn-skill Version: 2.0.0 The skill bundle implements a sophisticated multi-agent stock analysis framework but contains a critical shell injection vulnerability. The instructions in SKILL.md direct the agent to pipe raw, unsanitized LLM output into validation scripts using shell commands (e.g., `echo '<LLM_output>' | python3 ...`), which can be exploited to execute arbitrary commands if the LLM generates shell metacharacters. Additionally, pdf_generator.py renders LLM-generated content into HTML for PDF generation without sufficient sanitization, posing a risk of HTML/CSS injection during the report generation process.