10JQKA

操作同花顺炒股软件，覆盖盯盘、选股、自选、下单前检查、复盘等个人炒股全流程

This package appears internally consistent with its purpose, but it executes local shell commands and simulates keyboard input — both are powerful and can affect other windows or trigger unintended actions. Before installing: 1) review the shipped scripts (ths-hotkeys.mjs, run-all.mjs, etc.) yourself (they are included); 2) run initially in dry-run mode (run-all supports --dryRun) or on a test/VM machine; 3) restrict agent autonomous runs or require explicit user confirmation for any command that opens the trading client or interacts with the GUI; 4) be mindful that SendKeys/osascript will act on whatever window is focused (close or lock other sensitive apps while testing); 5) ensure Node and PowerShell are from trusted installs and that you understand where logs/trade-journal files are written (logs/ in the skill folder). If you want tighter control, require the agent to only produce command text for you to run manually rather than executing commands automatically.

Type: OpenClaw Skill Name: tonghuashu Version: 1.0.2 The skill bundle provides a framework for automating the 'Tonghuashun' trading platform using high-risk capabilities, specifically shell execution and GUI automation via PowerShell SendKeys (found in ths-hotkeys.mjs and run-all.mjs). While these capabilities are aligned with the stated purpose of automating trading workflows and the SKILL.md includes safety instructions requiring manual user confirmation for financial transactions, the use of keystroke injection and shell access to control a financial application represents a high-risk behavior. There is no evidence of malicious intent, data exfiltration, or persistence mechanisms; all logging and execution appear to be local.