Xueqiu Combo Report

End-to-end workflow for Xueqiu self-selected combo analysis from scraped or self-selected combo holdings batches through final ranking and PDF export. Use wh...

This skill appears to do what it says, but consider these points before installing or running: (1) The upstream collection step requires the agent's browser tool to run inside an already-logged-in Xueqiu session — that will expose session cookies and page content to the tool; only allow this if you trust the environment and the skill. (2) Review any batch JSON inputs and patch JSON carefully before merging; patches overwrite combos by symbol. (3) The scripts generate HTML by interpolating fields from input data without sanitization — treat untrusted input cautiously (malicious HTML could be embedded). (4) PDF rendering calls a local Chrome/Chromium binary (the script uses --no-sandbox when invoking it), so ensure you run in a safe, isolated environment if you have security concerns. (5) There are no hidden network endpoints or required secrets, and you can inspect the included Python scripts directly; run them locally or in an isolated container if you want to limit exposure.

Type: OpenClaw Skill Name: xueqiu-combo-report Version: 1.0.2 The skill provides a legitimate workflow for collecting, merging, and analyzing stock portfolio data from the Xueqiu financial platform. It includes Python scripts for data aggregation and report generation (JSON, Markdown, HTML, PDF) and a JavaScript snippet for browser-based scraping within an authenticated session. While `build_report.py` utilizes `subprocess.run` to invoke a local Chrome/Chromium binary for PDF rendering, the implementation is consistent with the tool's stated purpose and lacks indicators of malicious intent or data exfiltration.