指数通

用投资大师的脑子、呼兰的嘴，帮你搞懂指数和市场

What to consider before installing or running this skill: - If you only want the conversational/index-analysis behavior, you do NOT need to run the included install scripts — the SKILL.md describes a self-contained assistant that uses bundled references. Avoid running install.sh or cli/install.sh unless you trust the publisher and understand the changes. - The package contains installer/CLI code that will copy files into ~/.skillhub, ~/.local/bin, and ~/.openclaw, create wrappers, and configure a self-update URL. Those scripts also download archives from external hosts (skillhub-1388575217.cos.ap-guangzhou.myqcloud.com and lightmake.site). Running them gives the bundle persistent, auto-updateable presence on your system and the ability to configure the agent runtime. - Verify provenance before running any installer: confirm the publisher identity, hostnames, and tarball contents. Prefer reviewing the tarball locally (not piping curl | sh), and extract in a sandbox/VM to inspect files. If possible, run the skill in a restricted environment or container. - If you intend to install, consider these mitigations: set SKILLHUB_SKIP_SELF_UPGRADE=1 / SKILLHUB_SKIP_WORKSPACE_SKILLS=1 (or equivalent) to disable automatic updates/workspace installs; review and audit cli/skills_store_cli.py and cli/install.sh; check the URLs in cli/metadata.json and the install script; and avoid giving any credentials you do not intend to share. - Summary recommendation: SKILL.md content is coherent and looks benign for a finance assistant, but the presence of installers and automatic-update mechanisms that fetch code from external URLs is unexpected and elevates risk — treat this package as potentially risky unless you can verify and control the install process.

Type: OpenClaw Skill Name: stock-index Version: 2.0.1 The bundle installs a custom CLI tool and OpenClaw plugin designed to implement a private, 'CN-optimized' skill registry called 'Skillhub'. The primary risk indicators are found in 'install.sh' and 'cli/skills_store_cli.py', which implement an automated Over-The-Air (OTA) self-upgrade mechanism that fetches and executes remote Python scripts and ZIP archives from a Tencent Cloud COS bucket (skillhub-1388575217.cos.ap-guangzhou.myqcloud.com). While these capabilities are consistent with the stated goal of managing a skill ecosystem, the ability to modify local configurations and execute remote code automatically represents a significant attack surface for remote control or supply chain compromise.