openclaw-stock-skill
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a stock data interface for the Diemeng Chat API, providing access to A-share market data, ETFs, and indices.
- [SAFE]: API credentials ("STOCK_API_KEY") are managed via environment variables or a local configuration file, adhering to security best practices for secret management.
- [EXTERNAL_DOWNLOADS]: The skill connects to "data.diemeng.chat" and "mg.diemeng.chat" to fetch stock market information. These are the legitimate endpoints for the service provided by the author.
- [PROMPT_INJECTION]: The skill processes user-provided search queries and external API data, which represents an indirect prompt injection attack surface. However, the risk is minimal as the skill's capabilities are restricted.
- Ingestion points: User search queries in "search_stock_by_condition" and responses from the "diemeng.chat" API.
- Boundary markers: Not present in the instructions to the agent.
- Capability inventory: Operations are limited to network GET/POST requests using the "requests" library in "stock_api.py".
- Sanitization: Not implemented in the skill code; input validation and response parsing are handled by the remote API and the agent's core processing.
Audit Metadata