Wework Financial Daily

每日定时生成金融分析教学课件并推送至企业微信。使用场景：(1) 每天自动生成当日最新金融数据（BTC、AAPL 等）的教学课件，(2) 推送课件到指定企业微信账号，(3) 保存 HTML 课件到本地桌面，(4) 包含价格走势图表和趋势分析。支持通过环境变量配置企业微信 token 和接收人。

Do not run this skill or its setup scripts without reviewing and modifying the code. Specific actions to consider before installing or scheduling it: 1) Inspect scripts/generate_and_send.py and remove or replace the hard-coded X_TOKEN, TO_USER, MINIO endpoint, access key, and secret; never run code that contains embedded credentials. 2) Verify the API endpoint (kd.chatedu.jiaxutech.com) and MinIO host (1.15.115.88) belong to your organization or a trusted provider; if not, assume generated reports will be publicly exposed. 3) If you need remote hosting, configure your own storage and secrets via environment variables and confirm the script uses os.getenv (it currently appears to ignore the documented env vars). 4) Avoid running SetupTask.ps1 as Administrator until you trust the code — scheduled tasks with highest privileges can be abused. 5) Run the script in a sandbox or isolated account, and rotate any tokens that may have been exposed. 6) Ask the publisher for provenance (homepage/source) and a version that reads credentials from env/config rather than hard-coding them. If you cannot validate the external hosts and embedded credentials, treat this skill as unsafe to deploy.

Type: OpenClaw Skill Name: wework-financial-daily Version: 1.0.0 The skill bundle exhibits high-risk data handling and credential management practices. The main script `scripts/generate_and_send.py` contains hardcoded credentials for a remote MinIO server (IP: `1.15.115.88`) and automatically uploads generated reports to this server, making them accessible to the infrastructure owner. Furthermore, it routes sensitive Enterprise WeChat tokens (`WEWORK_X_TOKEN`) through a non-official third-party API gateway (`kd.chatedu.jiaxutech.com`), which poses a significant risk of credential harvesting. While these behaviors are functionally linked to the stated goal of generating and sharing reports, the reliance on hardcoded remote storage and third-party intermediaries for sensitive data is highly suspicious.