安全扫描
OpenClaw
可疑
medium confidenceThe skill's runtime instructions require an API key and make network calls to a specific domain, but the registry metadata does not declare the required credential or provenance—this mismatch and the unknown source warrant caution.
评估建议
Before installing or enabling this skill: (1) Confirm the provider and trustworthiness of the Meixiang API and the domain mkapi2.dfcfs.com — no homepage or source is provided. (2) Expect to provide an API key (MX_APIKEY) and treat it as a secret; verify why the registry metadata omitted that requirement and ask the publisher to update metadata to declare MX_APIKEY as required. (3) Consider network and data-leak risks: the skill will send your API key and queries to the listed endpoint and may sa...详细分析 ▾
ℹ 用途与能力
The SKILL.md describes a financial-data lookup skill using a Meixiang API and the described API endpoint (mkapi2.dfcfs.com) and payloads match the stated purpose. However, the registry metadata lists no required environment variables or primary credential while the instructions clearly require MX_APIKEY—this metadata omission is inconsistent.
✓ 指令范围
Runtime instructions are narrowly scoped to constructing a JSON payload, calling the documented POST endpoint with curl, parsing returned JSON fields, and optionally saving the full JSON to mx_data_result.json. The instructions do not ask the agent to read unrelated files or extra environment variables, but they do instruct optionally persisting API results to the local working directory (which may store sensitive data).
✓ 安装机制
This is an instruction-only skill with no install spec or code files, so nothing is written to disk by an installer. It relies on curl being available (not unusual) and performs network requests at runtime.
⚠ 凭证需求
The SKILL.md requires an API key via environment variable MX_APIKEY, but the skill's registry metadata declares no required env vars or primary credential. That mismatch is a red flag: the skill will ask users to provide a secret that the registry does not advertise. Additionally, the API key will be sent as an HTTP header to mkapi2.dfcfs.com, so users should treat it as sensitive.
✓ 持久化与权限
The skill is not always-enabled, and it does not request system-wide configuration or modify other skills. It only suggests optionally saving query results to a local JSON file under the working directory.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/14
mx-data v1.0.0 – 首次发布 - 新增支持通过妙想(Meixiang)API查询实时、权威的股票、基金、债券等金融行情。 - 提供上市及非上市公司财务指标、高管、主营业务、股东结构等信息查询。 - 支持股票、公司、高管等关联关系与企业经营相关数据的自然语言检索。 - 文档包含环境变量配置、API请求与响应解析、数据展示建议及用量注意事项。 - 仅面向明确金融/财务数据查询场景,不支持主观分析或非金融问题。
● 无害
安装命令 点击复制
官方npx clawhub@latest install mx-data
镜像加速npx clawhub@latest install mx-data --registry https://cn.clawhub-mirror.com
技能文档
Overview
此 Skill 通过妙想(Meixiang)金融数据接口,为用户提供实时、权威的金融数据查询能力,覆盖三大类信息:- 行情类 – 股票、行业、板块、指数、基金、债券的实时行情、主力资金流向、估值等。
- 财务类 – 上市公司及非上市公司的基本信息、财务指标、高管信息、主营业务、股东结构、融资情况等。
- 关系与经营类 – 股票、非上市公司、股东及高管之间的关联关系,以及企业经营相关数据。
Prerequisites
- 在 妙想 Skills 页面获取 API key。
- 将 API key 写入环境变量
MX_APIKEY:
export MX_APIKEY="your_api_key_here"
- 本地需安装
curl(macOS 默认已装)。
Usage Steps
- 构造请求 – 根据业务需求准备 JSON payload,最基本的字段为
toolQuery(查询关键词),如
{"toolQuery": "东方财富最新价"}
- 发送 POST 请求:
curl -X POST \
--location 'https://mkapi2.dfcfs.com/finskillshub/api/claw/query' \
--header 'Content-Type: application/json' \
--header "apikey:${MX_APIKEY}" \
--data '{"toolQuery": ""}'
- 解析响应 – 关键返回字段(仅展示需向下游暴露的核心内容):
data.questionId – 本次查询的唯一标识。
- data.dataTableDTOList – 标准化的证券指标数据列表,每个元素对应 1 个证券 + 1 个指标,包含 code、entityName、title、table(指标值)、nameMap(列名映射) 等。
- data.entityTagDTOList – 本次查询涉及的证券主体信息(代码、市场、证券类型、全名等),用于去重展示。
- data.condition – 本次查询的条件描述(关键词、时间范围等)。
- 返回给用户 – 将
title、关键指标值、关联证券(entityTagDTO)以可读表格或简要文字形式呈现。必要时可将完整 JSON 保存到工作目录(mx_data_result.json)。
Example
用户查询:"东方财富最新价"命令:
curl -X POST --location 'https://mkapi2.dfcfs.com/finskillshub/api/claw/query' \
--header 'Content-Type: application/json' \
--header 'apikey:${MX_APIKEY}' \
--data '{"toolQuery": "东方财富最新价"}'
返回(示例):
{
"status":0,
"message":"ok",
"data":{
"questionId":"Q20260314-001",
"dataTableDTOList":[{
"code":"300059.SZ",
"entityName":"东方财富 (300059.SZ)",
"title":"最新价",
"table":{"f2":[22.45]},
"nameMap":{"f2":"最新价"},
"indicatorOrder":["f2"]
}],
"entityTagDTOList":[{
"secuCode":"300059",
"marketChar":"SZ",
"entityTypeName":"A股",
"fullName":"东方财富",
"entityId":"ent_300059",
"className":"沪深A股"
}]
}
}
向用户展示:
- 证券:东方财富 (300059.SZ)
- 最新价:22.45 元
- 查询 ID:Q20260314-001
Data Size Warning
查询涉及大范围、长时间序列或大量证券时,返回数据量可能非常大,导致上下文超限或性能下降。建议在toolQuery 中加入 具体筛选条件(如具体股票代码、时间范围)或使用分页参数(若接口支持)。When Not to Use
- 非金融/非财务相关查询。
- 需要主观分析或意见建议的场景(本 Skill 只返回原始数据)。
References
- Meixiang API 文档(内部)。
- 示例查询表格列映射说明(
nameMap)。
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制