by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill appears to do what it claims (combine TradingView, Alpha Vantage, Yahoo data) but has several inconsistencies and supply-chain risks you should consider before installing or running any commands it recommends:
- Metadata mismatch: the registry lists no required env vars but the README/SKILL.md require ALPHAVANTAGE_API_KEY. Treat that as a correctness/quality issue — ask the publisher to update metadata.
- External code execution: the skill tells you to run mcporter and to call MCP pa...详细分析 ▾
ℹ 用途与能力
The SKILL.md/README describe a trading analysis skill that orchestrates TradingView, Alpha Vantage, and Yahoo Finance via mcporter MCP tools — that purpose is coherent with the listed mcporter calls and examples. However, registry metadata declares no required env vars while the README and SKILL.md clearly instruct the user to provide an ALPHAVANTAGE_API_KEY and to configure MCP servers, which is an omission/inconsistency. MCP server names also differ between files (e.g., tradingview-mcp vs tradingview-m, alphavantage vs alpha-vantage), suggesting sloppy metadata or copy/paste issues.
⚠ 指令范围
Instructions direct the agent/user to install and invoke external tooling (mcporter and MCP server packages) using npx/brew and to edit local config files (config/mcporter.json or ~/.mcporter/mcporter.json) and shell profiles to store API keys. These actions are within the skill's functional purpose but expand scope to fetching and executing third-party packages and modifying local config and shell profile files. The SKILL.md also contains examples that will cause network calls and arbitrary tool execution via mcporter; the skill gives broad discretion to run these external commands.
ℹ 安装机制
The registry lists no install spec, but the README encourages installing mcporter via npm/pnpm/Homebrew or using npx to run MCP packages (e.g., tradingview-m-mcp@latest, alpha-vantage-mcp@latest). That means executing code fetched from package registries or taps at runtime — a legitimate distribution choice but higher-risk than instruction-only local operations because the invoked packages can run arbitrary code. No direct download-from-untrusted-URL patterns are present, but relying on unverified 'latest' npm packages and an external brew tap increases supply-chain risk.
⚠ 凭证需求
Registry metadata declares no required environment variables, yet the README and SKILL.md explicitly instruct the user to set ALPHAVANTAGE_API_KEY (and show how to persist it in shell profiles or mcporter config). This mismatch is a red flag: the skill does need at least one credential for Alpha Vantage, and storing an API key in shell profile or config exposes it to the local environment and any processes that can read that file. There are no other unexplained credential requests, but the metadata/README disparity should be resolved.
✓ 持久化与权限
The skill does not request always:true and is not set to force installation. It instructs editing mcporter config files and adding environment variables, which is normal for a tool that orchestrates external services. It does not request to modify other skills or system-wide agent settings beyond configuring mcporter servers and env mappings.
安全有层次，运行前请审查代码。
运行时依赖
🖥️ OSmacOS · Linux · Windows
版本
latestv0.0.62026/2/10
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install drunk-trading-analyzer
镜像加速npx clawhub@latest install drunk-trading-analyzer --registry https://cn.longxiaskill.com