Xiaodi Financial Team

金融分析师团队 - 股票分析、基金推荐、持仓复盘、投资决策

This skill appears to be a coherent financial-analysis assistant that uses public market and news APIs. Two things to verify before installing: (1) metadata and architecture reference the 'exec' tool and a script (stock_analysis.py) that are not included — ask the author why exec permission is declared and whether any code will be executed on your host (exec increases risk because it can run arbitrary commands). (2) Confirm the provenance: the package claims a GitHub/homepage; inspect that repository for the missing script(s) and any code that would run. If you don't need command execution, prefer a version that does not require 'exec' and that declares any external APIs/credentials explicitly. Consider running the skill in a sandboxed environment or reviewing the upstream repo before granting it elevated tool access.

Type: OpenClaw Skill Name: xiaodi-financial-analysis-team Version: 2.0.0 The skill bundle describes a complex multi-agent financial analysis system that requires high-privilege capabilities, including the 'exec' tool for the 'business-opportunity-analyst' and the use of shell-based 'curl' commands within its instructions (collaboration-guide.md). While these features are intended to fetch real-time market data from legitimate financial endpoints (e.g., gtimg.cn, eastmoney.com), the inclusion of raw execution capabilities and shell commands in the agent's logic significantly increases the risk of prompt injection leading to arbitrary command execution. No clear evidence of intentional malice or data exfiltration was found, but the architectural risk qualifies as suspicious.