天天Skills

天天条件选基 Skill。使用 FUND_CONDITION_SELECT 能力按基金分类、风险等级、费率、收益和回撤等条件进行筛选，返回候选基金与关键分析字段。

This skill appears to do what it says (filter funds) and only needs a single API key at runtime, but the package metadata fails to declare that requirement. Before installing or using it: (1) confirm the caller endpoint (https://skills.tiantianfunds.com/...) is the legitimate provider and reachable over TLS; (2) verify where the TTFUND_APIKEY truly comes from and avoid pasting secrets into untrusted places; (3) prefer providing the API key only for the session (or via a mechanism you control) rather than setting a long-lived global env var if you have concerns; (4) ask the skill publisher or registry to update metadata to declare TTFUND_APIKEY as a required/primary credential so the platform can surface that requirement to users. If you cannot verify the endpoint or the source of the apikey, treat the skill as untrusted and do not supply secrets.

Type: OpenClaw Skill Name: ttfund-condition-select Version: 1.0.0 The skill bundle provides a legitimate interface for querying fund data from Tiantian Fund (天天基金) via an official-looking API endpoint (skills.tiantianfunds.com). The instructions in SKILL.md correctly guide the agent to handle the TTFUND_APIKEY environment variable securely, ensuring it is only sent to the designated service and providing clear error handling and user guidance for configuration. No malicious patterns, obfuscation, or unauthorized data exfiltration behaviors were detected.