📦 AI Investment Analyzer — AI投资助手
v1.1.1集成股票、加密货币与房地产三大市场的实时数据分析引擎，一键完成风险评估、收益预测与策略优化，为投资者提供量化决策依据。
0· 163·1 当前·1 累计
by 下载技能包
最后更新
2026/4/1
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
What to consider before installing:
- Treat this as a demo/local tool, not a production trading system. The code uses simulated/mock prices and does not implement real-time API integration out-of-the-box.
- Do NOT reuse or trust the ClawHub login token found in publish-manual.txt — it appears to be an embedded secret. If you manage or mirrored this repo, rotate any exposed tokens/credentials and remove them from the repository history.
- If you intend to connect real data providers (Yahoo/Alpha...详细分析 ▾
ℹ 用途与能力
Name, description, SKILL.md and the Node.js code align: the skill provides stock/crypto/real-estate analysis, portfolio optimization and risk assessment. However the SKILL.md and README advertise 'real-time data API integration' yet the package declares no required env vars/credentials and the code uses only simulated/mock data. This mismatch (advertised external API integration vs no declared credentials) is plausible for an early/demo release but is a point worth noting.
ℹ 指令范围
Runtime instructions are limited to running the included CLI commands (analyze, portfolio optimize, risk assess, forecast). The SKILL.md does not instruct reading unrelated system files or exfiltrating data. However repository files (publish-manual.txt) contain instructions and a ClawHub login token which would allow external publishing of the repository — that is unrelated to the skill's runtime purpose and introduces an external-facing risk.
✓ 安装机制
There is no install spec (instruction-only install method), and no remote downloads or extract steps. This lowers installation risk. The included Node.js files run locally and only read/write a local analysis_log.json file.
⚠ 凭证需求
The skill declares no required environment variables or primary credential, which is consistent with its current simulated-data implementation — but examples/config.json and the prose discuss API keys for data providers. More importantly, publish-manual.txt embeds a ClawHub token (token:clh_stbFXRYc9RTR1Ck7e940tJ1e4AN0EU8X5S_MhoC8MFM). An embedded publish/login token in the repository is disproportionate and potentially sensitive: it could be misused to post or modify content on the referenced platform.
✓ 持久化与权限
The skill does not request always: true and does not modify other skills or system-wide settings. The runtime writes a local analysis_log.json (normal for a CLI tool). There is no evidence the skill attempts to persistently elevate privileges or auto-enable itself.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.1.12026/4/1
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install ai-investment-analyzer
镜像加速npx clawhub@latest install ai-investment-analyzer --registry https://cn.longxiaskill.com