by 安全扫描
OpenClaw
安全
high confidenceThe skill's code, required environment variable, and runtime instructions are consistent with a market-data & trading assistant that configures FIU MCP endpoints and uses a single FIU_MCP_TOKEN; nothing indicates misdirection or unrelated credential requests.
评估建议
This skill appears to be what it claims (market data + trading via FIU MCP) and only asks for one token (FIU_MCP_TOKEN). Before installing or running: 1) Treat the FIU_MCP_TOKEN as sensitive — do not share it. 2) Review ~/.mcp.json after setup: the skill will create/overwrite that file (it does back it up as ~/.mcp.json.bak) and add seven ai.szfiu.com endpoints; if you use other MCP tools, merge rather than blindly overwrite. 3) Inspect the included scripts/install.sh yourself and run them manua...详细分析 ▾
✓ 用途与能力
Name/description, required env var (FIU_MCP_TOKEN), declared binaries (curl, jq, date, bash), and the scripts all consistently target FIU MCP endpoints (ai.szfiu.com) and implement market queries and simulated/real trades. The requested token is proportional and expected for this purpose.
ℹ 指令范围
Runtime instructions and scripts do more than just network calls: they create a ~/.fiu-market/config file and create/overwrite ~/.mcp.json (with a backup). That behaviour is coherent with the stated goal (integrating with MCP), but it modifies a shared configuration file used by other MCP-enabled tools — you should be aware it will change files in your home directory and may affect other tools.
✓ 安装机制
There is no remote download/install URL; the repository includes shell scripts (install.sh, scripts/*.sh) and the SKILL.md expects the agent to run local bash commands. No archives or external code-hosting downloads are fetched during install. All external network calls go to ai.szfiu.com, which matches the skill's claimed service.
✓ 凭证需求
Only FIU_MCP_TOKEN is required (declared as sensitive). No unrelated credentials or broad environment access are requested. The scripts read/write only user-local config files and the FIU token, which is proportionate to the functionality.
ℹ 持久化与权限
The skill is not always-enabled and does not request elevated platform privileges, but it writes persistent config files (~/.fiu-market/config and ~/.mcp.json). That persistent change to ~/.mcp.json could affect other MCP integrations; the scripts create a backup but will overwrite by default. Also real trading requires interactive confirmation in scripts (read -p), which may behave unexpectedly if run non-interactively by an agent.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.132026/4/8
Version 1.0.13 - Major update: Added quick setup, argument-based dispatching, and extensive documentation in English. - Introduced new CLI scripts and install methods for easier deployment (install.sh, scripts/cli.sh, scripts/mcp_router.sh). - Added detailed user guidance for market data/trading commands across HK, US, and CN markets. - Included Chinese and English interface documentation and usage references. - Skill metadata and security instructions updated for token and config management.
● 可疑
安装命令
点击复制官方npx clawhub@latest install fiu-market-assistant
镜像加速npx clawhub@latest install fiu-market-assistant --registry https://cn.longxiaskill.com 镜像可用
本土化适配说明
SZFIU Market Data Bot — 技能工具 安装说明： 安装命令：npx clawhub@latest install fiu-market-assistant 该技能用于支付宝相关操作，可能需要相应的平台账号或API密钥
技能文档
Provides stock market data query and trading capabilities via FIU MCP Server. Supports HK, US, and CN stock markets with quotes, K-line, order book, capital flow, and trading operations.
Arguments passed: $ARGUMENTS
Quick Start (One Command Setup)
# First time setup - configure MCP and set token
/fiu-market-assistant setup YOUR_FIU_MCP_TOKEN
After setup, simply use natural language:
Query Tencent Holdings quote
Show AAPL daily K-line
Buy 100 shares Tencent
Dispatch on Arguments
No args — show status
- Check FIU_MCP_TOKEN - show if token is configured (masked)
- Show available markets - list HK, US, CN, toolkit
- Show quick commands - list available dispatch commands
- What next - guide user:
/fiu-market-assistant setup to configure"
- Configured → "Ready! Ask me anything like 'Query 00700 quote'"setup — quick setup (recommended)
- Save token to config file
~/.fiu-market/config - Create MCP config
.mcp.jsonwith all 7 FIU services - Test connectivity
- Confirm and guide restart
test — test connectivity
- Check FIU_MCP_TOKEN is set
- Test each market endpoint with tools/list
- Show which services are working
- Report any errors
discover — discover available tools
List all available tools for a specific market:
/fiu-market-assistant discover hk_sdk
/fiu-market-assistant discover cn_sdk
quote — query quote
Query real-time quote for a stock:
/fiu-market-assistant quote 00700
/fiu-market-assistant quote AAPL
/fiu-market-assistant quote 600519
kline [type] — query K-line
Query K-line data:
/fiu-market-assistant kline 00700 # daily
/fiu-market-assistant kline 00700 1 # weekly
/fiu-market-assistant kline AAPL 5 # 1-min for US
search — search stock code
Search for stock by name:
/fiu-market-assistant search 腾讯
/fiu-market-assistant search Apple
trade [price] — trade
Place orders (default SIMULATE mode):
/fiu-market-assistant trade buy 00700 100 380
/fiu-market-assistant trade sell AAPL 50 150
/fiu-market-assistant trade buy 600519 1000 200
positions — query positions
/fiu-market-assistant positions
cash — query cash
/fiu-market-assistant cash
orders — query orders
/fiu-market-assistant orders
capflow — capital flow
/fiu-market-assistant capflow 00700
MCP Servers Reference
Market Endpoints
| Service | Market | URL |
|---|---|---|
| stockHkF10 | HK F10 | https://ai.szfiu.com/stock_hk_f10/ |
| stockUsF10 | US F10 | https://ai.szfiu.com/stock_us_f10/ |
| stockCnF10 | CN F10 | https://ai.szfiu.com/stock_cn_f10/ |
| stockHkSdk | HK SDK | https://ai.szfiu.com/stock_hk_sdk/ |
| stockUsSdk | US SDK | https://ai.szfiu.com/stock_us_sdk/ |
| stockCnSdk | CN SDK | https://ai.szfiu.com/stock_cn_sdk/ |
| szfiuToolkit | Search | https://ai.szfiu.com/toolkit/ |
Feature Support by Market
| Feature | HK (港股) | US (美股) | CN (A股) |
|---|---|---|---|
| Quote | ✅ | ✅ | ✅ |
| K-line | ✅ | ✅ | ✅ |
| Order Book | ✅ | ✅ | ✅ |
| Tick Data | ✅ | ✅ | ✅ |
| Intraday | ✅ | ✅ | ✅ |
| Capital Flow | ✅ | ✅ | ✅ |
| Capital Distribution | ✅ | ✅ | ✅ |
| Sector List | ✅ | ✅ | ✅ |
| Stock Filter | ✅ | ✅ | ✅ |
| Market Ranking | ✅ | ✅ | ✅ |
| F10 Data | ✅ | ✅ | ✅ |
| Trading | ✅ | ✅ | ✅ |
| Search | ✅ | ✅ | ✅ |
Usage Tips
- Use search first to find correct stock code
- Default mode is SIMULATE - use "REAL" for real trading
- HK stocks: use format
00700.HKor just00700 - US stocks: use format
AAPLorAAPL.US - CN stocks: use format
600519.SZor000001.SZ - Rate limit: 15 orders per 30 seconds
- Get token: https://ai.szfiu.com/auth/login
Important Notes
- Trading defaults to SIMULATE mode for safety
- Real trading requires explicit "REAL" confirmation
- Always check market status before trading
- The setup command will create/overwrite ~/.mcp.json (standard MCP config file)
- Backup is created automatically before overwriting
- Config files are stored with restricted permissions (600) - only owner can read
- This skill adds 7 FIU MCP entries to your MCP configuration
- Other MCP-enabled tools may also use ~/.mcp.json - review after setup if needed