by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do exactly what it says: call 东方财富 push2 APIs and format a report. It asks for no secrets and has no install step, so the risk is low. Two practical points to consider before running: (1) The script uses plain HTTP endpoints (http://push2.eastmoney.com) — that can allow tampering on untrusted networks; consider switching to HTTPS endpoints if available or run on a trusted network. (2) The script makes outbound network requests and prints to stdout; if you plan to schedule i...详细分析 ▾
✓ 用途与能力
Name/description claim: fetch 东方财富 data and produce a daily A股 report. The included script directly calls 东财 push2 APIs, parses results, and formats Markdown/JSON output. Required env, credentials, and binaries are none — consistent with the simple Node.js script.
✓ 指令范围
SKILL.md instructs running the bundled Node script and optionally redirecting stdout to files. The runtime instructions do not ask the agent to read unrelated files, access secrets, or send data to third-party endpoints other than the listed 东方财富 APIs. No vague 'gather whatever you need' directives are present.
✓ 安装机制
Instruction-only with a single included JS file; no install spec or remote downloads. This minimizes installation risk — nothing arbitrary is fetched or written during install.
✓ 凭证需求
No environment variables, credentials, or config paths are requested. The script only requires Node.js and makes outbound HTTP(S) requests to the stated APIs, which is proportional to its purpose.
✓ 持久化与权限
Skill is not always-enabled, does not modify other skills or system settings, and does not persist credentials. It only prints output to stdout; optional instructions suggest the user redirect output to user documents, which is normal and local.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/13
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install a-stock-daily-report
镜像加速npx clawhub@latest install a-stock-daily-report --registry https://cn.longxiaskill.com