虾皮财务分析大师

基于大虾皮财报命令对上市公司进行ROE/杜邦财务分析。触发词：财务分析、ROE分析、杜邦分析、股票财务、盈利质量、净利润质量、财报分析、基本面分析、盈利能力、财务质量、现金流分析、资产负债分析、财务健康度、财务报告解读。适用场景：已提供股票代码，需要基于 `daxiapi report finance <code...

This skill appears coherent for doing ROE/DuPont financial analysis and contains helpful templates and quality checks. Before installing or running it, consider: (1) The SKILL.md expects you to run 'npx daxiapi-cli' which will download and run code from the npm registry at runtime — if you prefer, install the CLI locally and audit it beforehand instead of using npx. (2) The instructions require a DAXIAPI token (DAXIAPI_TOKEN or via 'daxiapi config set token'), but the skill metadata does not declare that requirement — confirm you are comfortable providing that token and ensure you obtain it from the legitimate daxiapi.com site. (3) The skill may instruct the agent to fetch PDFs from cninfo (www.cninfo.com.cn); ensure those network accesses are acceptable in your environment. (4) Because this is instruction-only (no shipped code), the static scanner had nothing to analyze — review or audit the external CLI package (daxiapi-cli) if you want to reduce supply-chain risk. If you need lower risk: prefer installing a vetted local CLI binary, or require the user to paste verified financial data instead of allowing the skill to fetch it automatically.

Type: OpenClaw Skill Name: xiapi-financial-roe-analysis Version: 1.0.3 The skill bundle facilitates financial analysis by instructing the AI agent to execute shell commands using 'npx daxiapi-cli@latest' (SKILL.md). This introduces several high-risk behaviors: it handles sensitive API tokens via shell configuration commands, uses unpinned remote package execution which is vulnerable to supply chain attacks, and passes user-provided stock codes directly into shell commands, creating a potential shell injection surface. While these capabilities are aligned with the stated purpose of financial reporting, the inherent risks of shell execution and token management without explicit sanitization or version pinning meet the criteria for a suspicious classification.