by 安全扫描
OpenClaw
可疑
medium confidence技能内容与其声明的可转债分析目的一致，但引用了外部数据源tushare并进行实时检查，却未声明凭据或网络访问，使用前请核实该未说明的缺口。
评估建议
This skill appears to be a legitimate convertible-bond analysis guide and code examples, but it references tushare for data without declaring how credentials will be supplied. Before installing or using it, verify: (1) whether the agent will perform network calls and to which endpoints; (2) how you should supply any API token (avoid pasting secrets into an unfamiliar skill or chat); (3) if you prefer, run the provided Python snippets locally against data you control instead of giving remote acce...详细分析 ▾
ℹ 用途与能力
The name/description (A股可转债分析框架) align with the provided instructions and code snippets (三维估值、条款博弈、双低策略、轮动等). No unrelated binaries, installs, or env vars are requested. However, the SKILL.md explicitly cites data retrieval via 'tushare' — a network API that normally requires an API token — but the skill does not declare any required credential or explain how data access will be handled.
ℹ 指令范围
The runtime instructions and code samples stay within the domain of bond valuation, strategy signals, and backtest framework. They do not instruct reading arbitrary system files or modifying other skills. The only external-scope action is a recommendation to fetch convertible-bond OHLCV and metadata via tushare (implies network I/O and authenticated API calls), and to '每天检查强赎公告' (daily monitoring) — but there are no concrete endpoints or data-handling safeguards described.
✓ 安装机制
This is an instruction-only skill with no install spec and no code files to execute or drop on disk. That is low-risk from an installation/execution perspective.
⚠ 凭证需求
The skill requests no environment variables or credentials, yet explicitly names 'tushare' as the required data source. Tushare typically requires an API token; the skill gives no guidance on where that token is expected (env var, prompt, config) nor declares it in metadata. This mismatch could lead the agent to prompt the user for credentials at runtime or to attempt unauthenticated network calls — both are potential security/privacy concerns.
✓ 持久化与权限
The skill does not set always:true and does not request persistent system-level privileges or modify other skills. Autonomous invocation is allowed (platform default) but not elevated by this skill.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/13
Initial release of 可转债分析 skill for A股市场： - 提供可转债三维估值框架：涵盖转股价值、纯债价值、期权价值算法与解释。 - 梳理条款博弈要点，包括下修、强赎和回售情形及投资应对思路。 - 收录双低策略与轮动选债逻辑，含数据筛选条件与回测框架参考。 - 附详细核心要素表、常用公式、风险提醒与标准输出模板。
● 无害
安装命令
点击复制官方npx clawhub@latest install convertible-bond-4cnmarket
镜像加速npx clawhub@latest install convertible-bond-4cnmarket --registry https://cn.longxiaskill.com