安全扫描
OpenClaw
可疑
medium confidence该技能主要符合其声明的财务目的，但存在显著不一致（未在注册元数据中声明计费 API 密钥）、增加风险的运行行为（运行时 pip 安装、在用户主目录下写入文件系统以及 SKILL.md 中检测到提示注入模式），因此请谨慎使用。
评估建议
["元数据不匹配：注册表列出没有必需的环境变量，但 SKILL.md 和 billing.py 需要 SKILLPAY_API_KEY。确认是否必须提供 API 密钥以及在提供凭据之前是否信任 SkillPay.me 端点。","计费：billing.py 将调用 https://skillpay.me 并以每次调用 0.001 USDT 计费；不要将您的 SKILLPAY_API_KEY 提供给不受信任的技能或环境。","动态安装：脚本在运行时通过 pip 自动安装 'yfinance'。如果您需要更严格的控制，请在沙盒中预安装和审查依赖项。","文件写入：技能在 ~/.openclaw/workspace/finance-radar/data 下读写数据（投资组合、观察列表、CSV 导出）。如果您想避免持久文件，请在可丢弃环境中运行它。","提示注入指标：SKILL.md 因为 Unicode 控制字符而被标记；请向发布者请求原始 SKILL.md 或自己检查隐藏的控制字符或模糊的文本。","起源和信任：源为 '未知'，没有提供主页。如果您计划使用真实凭据或敏感数据来使用此技能，请...详细分析 ▾
⚠ 用途与能力
The skill's name/description (Yahoo Finance analysis + billing) aligns with the included scripts (analysis, scoring, watchlist, portfolio, billing). However the registry metadata lists no required environment variables while SKILL.md and scripts clearly require SKILLPAY_API_KEY for billing; this mismatch is unexplained and an incoherence to surface to users.
⚠ 指令范围
SKILL.md instructs the agent to run included Python scripts and to call billing first. The scripts perform network calls (yfinance via pip-installed package and SkillPay.me HTTP API), read/write JSON under ~/.openclaw/workspace/finance-radar/data, and may install dependencies at runtime. SKILL.md was flagged for unicode-control-chars (possible prompt-injection attempt); while the code itself looks finance-related, the SKILL.md contains injection signals that warrant manual review.
ℹ 安装机制
There is no formal install spec (instruction-only), but the scripts call subprocess to pip-install 'yfinance' on demand. Dynamic pip installs are common but do fetch code from the network at runtime (and may pull transitive dependencies). This increases runtime attack surface compared to a bundled dependency list.
⚠ 凭证需求
The only environment secret referenced in the instructions/code is SKILLPAY_API_KEY (used by scripts/billing.py). That is proportionate to the described billing feature, but the registry metadata not listing any required env vars is inconsistent. No unrelated credentials are requested, which is good, but the missing metadata entry is a red flag.
✓ 持久化与权限
The skill does not request special platform privileges and 'always' is false. It writes to a per-skill directory under the user's home (~/.openclaw/workspace/finance-radar/data) for portfolio/watchlist CSV/JSON — expected for this functionality. The skill can be invoked autonomously (platform default) but that alone is not flagged.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.1.02026/3/6
● 无害
安装命令 点击复制
官方npx clawhub@latest install finance-radar
镜像加速npx clawhub@latest install finance-radar --registry https://cn.clawhub-mirror.com
技能文档
（由于原始内容较长，以下为简略翻译，保留关键结构）
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制