虾皮市场风格轮动分析

分析A股大小盘风格轮动，通过中证2000与沪深300的相对强弱差值判断风格偏向与切换信号。触发词：大小盘风格、风格轮动、大盘股小盘股、风格切换、沪深300、中证2000、微盘股投资策略。适用场景：判断市场风格偏向、识别风格切换信号、大盘小盘配置决策。不适用场景：个股分析、行业板块分析、债券分析。

Before installing, verify these items: 1) The skill's metadata should declare that it needs an API token and a local npm runtime (npx). Ask the author to add required env vars (e.g., DAXIAPI_TOKEN) and required binaries (node/npm). 2) Understand that runtime uses 'npx ...@latest' — npx will download and execute remote npm code each time; prefer a pinned version (not @latest) or a vetted binary. 3) Confirm you trust the daxiapi service and the npm package owner (check homepage, source repo, and package contents). 4) Be cautious storing tokens in persistent config files (~/.daxiapirc); use temporary environment variables where possible and do not check tokens into repos. 5) If you need stronger guarantees, request the author provide a static manifest (exact npm package version or a bundled, audited implementation) and explicit declaration of all required env vars and config paths. 6) If you will allow autonomous invocation, be aware the agent could run npx and access the token — only enable that if you trust the skill and its source. If any of the above cannot be confirmed, treat the skill as higher risk and avoid installing or run it in a restricted/test environment first.

Type: OpenClaw Skill Name: xiapi-style-rotation Version: 1.0.1 The skill facilitates financial market analysis by interfacing with an external service via the 'daxiapi-cli' tool. It is classified as suspicious because it directs the AI agent to execute shell commands using 'npx daxiapi-cli@latest', which introduces supply chain risks by fetching unpinned remote code. Additionally, the instructions for configuring API tokens (SKILL.md and references/token-setup.md) involve passing user-provided strings directly into shell commands, creating a potential surface for shell injection attacks if the agent does not properly sanitize inputs.