Qiaofuture Boston Stock King

巧未来·波龙股神 - 游戏化AI选股系统。学来学去学习社出品，"有钱就有未来"，支持选股、香火随喜、电话安慰、奶茶关怀

This skill implements what it promises (stock picks + gamified 'care' features) but also asks for sensitive personal data and encourages payments to QR codes hosted on the developer's cloud storage. Before installing/relying on it: - Don't submit real phone numbers, addresses, or ID photos until you confirm how the data will be used, stored, and deleted; test with dummy data first. - Inspect the payment QR images/URLs and verify whose account they belong to — treat any payment request as money sent to the developer unless proven otherwise. - Review the ai-calls-china-phone and tts optional skills before installing them (they may require call/SMS permissions and have separate costs). - If you will run the Python scripts, run them in a sandbox or isolated environment and audit the code paths that handle uploads, network calls, and file writes. - Consider legal/regulatory implications: the skill offers financial recommendations and promotional upsells; ensure you are comfortable with the disclaimers and do not treat outputs as professional investment advice. Given these privacy/payment/social‑engineering risks (but no clear malware), proceed only after verifying payment recipients and data handling practices, or prefer a version that omits PII collection and payment QR guidance.

Type: OpenClaw Skill Name: qiaofuture-boston-stock-king Version: 3.0.0 The skill bundle is classified as suspicious due to its heavy focus on financial solicitation and the collection of personally identifiable information (PII). Multiple scripts, including bolong_picker_v2.py and bolong_photo.py, contain hardcoded URLs to payment QR codes (e.g., hosted on myqcloud.com) and implement a gamified 'incense' system that encourages users to donate money in exchange for 'VIP' stock picks or 'better' algorithms. Furthermore, bolong_care.py and bolong_photo.py are designed to solicit and store sensitive user data, such as physical addresses, phone numbers, and personal photos, under the guise of 'milk tea' delivery and 'AI photo' creation. While the code lacks traditional malware like backdoors or automated credential theft, the combination of social engineering for money and PII collection is highly characteristic of financial scams.