SKILLEMALL.ai
GitHub ↗ RU Sign in

CF A-stock-report

A股数据驱动型报告自动生成与推送系统，支持晨报 / 收盘小结 / 晚报 / 盘中预警 / IPO周报 / 财经周末版。内置投资者情绪打分（6维度，满分100）与AI后市展望。

ClawHub Agent Skills author: Victor Shen v3.5.4 MIT-0 24 files body ≈ 5 079 tokens Open the sourceclawhub.ai↗ analyzed 3 d ago

As a process F 38/100 · Will not run — References files that are not bundled: knowledge/changelog/README.md, knowledge/changelog/v3.5.1.md, knowledge/changelog/v3.4.4.md

ProcedureData and analyticsInfrastructuretype and topics are labelled automatically from the skill text
Runs in: OpenClaw Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) Goose OpenCode
JSON
Technical rating
C
69/100
safety, quality, tests
Safety 60%
88
Quality 40%
41
Run on models
none yet
Process rating
F
38/100
Will not run
References files that are not bundled: knowledge/changelog/README.md, knowledge/changelog/v3.5.1.md, knowledge/changelog/v3.4.4.md
Tools and files w 18
0
Result and completion w 14
0
Inputs and preconditions w 11
0
the three weakest of ten parameters · all ten

How to improve

  1. Say in the description WHEN to use the skill ("use when…", example requests): that is the agent's main cue.
  2. The SKILL.md body is over 5,000 tokens: move reference detail into references/ and load it when needed.
  3. The text references files that are not there: add them or drop the references.
For the model run — optional
  • Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
  • A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 12

✓ No critical or high findings

Medium and low: 12
  • low Exfiltration read-dotenv cron_jobs/cron_mirror.json:15
    Reads a .env file (detector / deny-list definition)
    "prompt": "source /workspace/.env && python3 /root/.hermes/skills/A-stock-report/scripts/send_close_summary.py",
    detector
  • low Exfiltration read-dotenv cron_jobs/cron_mirror.json:30
    Reads a .env file (detector / deny-list definition)
    "prompt": "source /workspace/.env && python3 /root/.hermes/skills/A-stock-report/scripts/send_intraday_alert.py 2>&1",
    detector
  • low Exfiltration read-dotenv cron_jobs/cron_mirror.json:56
    Reads a .env file (detector / deny-list definition)
    "prompt": "source /workspace/.env && python3 /root/.hermes/skills/A-stock-report/scripts/send_ipo_report.py",
    detector
  • low Exfiltration read-dotenv scripts/check_consistency.py:191
    Reads a .env file (detector / deny-list definition; security demo / example)
    """E. SKILL.md 主体（任务清单段之外）禁止出现 cron 表达式和 source .env 命令
    detectordemo
  • low Exfiltration read-dotenv scripts/check_consistency.py:277
    Reads a .env file (detector / deny-list definition)
    v3.2.5 修复动机：v3.1.4 已把收盘小结/IPO 周报改成 `source .env && python3 send_*.py`
    detector
  • low Exfiltration read-dotenv scripts/check_consistency.py:348
    Reads a .env file (detector / deny-list definition)
    print(f"        source /workspace/.env && python3 /root/.hermes/skills/A-stock-report/scripts/send_XXX.py 2>&1")
    detector
  • low Exfiltration read-dotenv SKILL.md:140
    Reads a .env file (detector / deny-list definition)
    所有 6 个任务的完整命令（`source .env` + `python3 脚本路径` + 可选参数）都集中在 **`cron_jobs/cron_mirror.json` 的 `tasks.<name>.prompt` 字段**。
    detector
  • low Exfiltration read-dotenv SKILL.md:151
    Reads a .env file
    # 2. 复制粘贴该命令到终端跑（已含 source .env + python3 路径 + 默认参数）
  • low Exfiltration read-dotenv SKILL.md:531
    Reads a .env file (detector / deny-list definition)
    - **独立脚本型（3 个）**：收盘小结 / **盘中预警** / IPO 周报 — 无需 LLM，调度配置外置于 `cron_jobs/`，由 OpenClaw gateway 直接 `source .env && python3 ...` 跑脚本。盘中预警为每 5 分钟一次高频任务（必须无 LLM 介入）。
    detector
  • low Exfiltration read-dotenv templates/evening.json:2
    Reads a .env file (detector / deny-list definition; security demo / example)
    "prompt": "1. 调用晚报数据采集脚本，将结果写入约定路径：\n   source /workspace/.env && python3 /root/.hermes/skills/A-stock-report/scripts/collect_evening_data.py\n   \n   采集内容：六大指数、亚太股市、两融余额、两融比例、沪深300 PE分位数、股市风险溢价（ERP）等
    detectordemo
  • low Exfiltration read-dotenv templates/morning.json:2
    Reads a .env file (detector / deny-list definition; security demo / example)
    "prompt": "0. 【强约束 — LLM 必读】渲染晨报前必须先 cat /tmp/morning_data.json 读真实数字：\n   cat /tmp/morning_data.json\n   然后仅用其中真实数字填充模板占位符（XXXXX.XX = price、+X.XX% = pct、XX.XX = vix.value 等）。\n   严禁凭模型知识/印象/历史样本自编数字（
    detectordemo
  • low Exfiltration read-dotenv templates/weekend.json:2
    Reads a .env file (detector / deny-list definition; security demo / example)
    "prompt": "1. 用 batch_web_search 搜索以下内容（v3.4.3 2026/06/16 立 — 4 类查询 (经济政策/宏观数据/A 股重大事件/海外市场大事件) + 48h 时间窗 + 6-8 条 + 一句话摘要 + Q3-2 砍 [下周展望] 的 [外围市场] + [A 股预判] 段；v3.4.2 5 类 → 1 类；v3.4.1 1500 字 + 防幻觉 + 1
    detectordemo

Files scanned: 24. Evidence is masked. Grey chips explain why severity was lowered.

Against the Agent Skills spec

  • warning name-format name should be kebab-case (lowercase letters, digits, hyphens)
  • warning description-no-when description does not say WHEN to use the skill (no "use when")
  • warning body-long SKILL.md body ≈ 5079 tokens (recommended < 5000); move details to references/
  • warning missing-ref reference to a missing file: knowledge/changelog/README.md
  • warning missing-ref reference to a missing file: knowledge/changelog/v3.5.1.md
  • warning missing-ref reference to a missing file: knowledge/changelog/v3.4.4.md
  • warning missing-ref reference to a missing file: knowledge/changelog/v3.3.5+5.md
  • warning missing-ref reference to a missing file: knowledge/changelog/v3.3.5+4.md
  • warning missing-ref reference to a missing file: knowledge/changelog/v3.3.5+3.md
  • warning missing-ref reference to a missing file: knowledge/changelog/v3.3.5+2.md
  • warning missing-ref reference to a missing file: knowledge/changelog/v3.3.5+1.md
  • warning missing-ref reference to a missing file: knowledge/changelog/v3.3.5.md
  • warning missing-ref reference to a missing file: knowledge/changelog/v3.3.4.md
  • warning missing-ref reference to a missing file: knowledge/changelog/v3.3.3.md
  • warning missing-ref reference to a missing file: knowledge/changelog/v3.3.2.md
  • warning missing-ref reference to a missing file: knowledge/changelog/v3.3.1.md
  • warning missing-ref reference to a missing file: knowledge/changelog/v3.3.0.md
  • warning missing-ref reference to a missing file: knowledge/changelog/v3.2.9.md
  • warning missing-ref reference to a missing file: knowledge/changelog/v3.2.8.md
  • warning missing-ref reference to a missing file: knowledge/changelog/v3.2.7.md
  • warning missing-ref reference to a missing file: knowledge/changelog/v3.2.6.md
  • warning missing-ref reference to a missing file: knowledge/changelog/v3.2.5.md
  • warning missing-ref reference to a missing file: knowledge/changelog/v3.2.4.md
  • warning missing-ref reference to a missing file: knowledge/changelog/v3.2.3.md
  • warning missing-ref reference to a missing file: templates/<task>.json
  • warning missing-ref reference to a missing file: templates/*.json
  • warning missing-ref reference to a missing file: templates/intraday.json

Process rating: all ten parameters 38/100

Will not run. References files that are not bundled: knowledge/changelog/README.md, knowledge/changelog/v3.5.1.md, knowledge/changelog/v3.4.4.md
  • 0Tools and files. 24 referenced file(s) missing: knowledge/changelog/README.md, knowledge/changelog/v3.5.1.md, knowledge/changelog/v3.4.4.md
  • 0Result and completion. Does not say what the result is
  • 0Inputs and preconditions. Does not say what the process needs to start
  • 20When it triggers. No condition that starts the skill
  • 30Running it twice. 33 mutating operations with no state check
  • 50Failures and branches. 0 branches, has a failure section
  • 70Execution cost. Instruction body is 5079 tokens
  • 100Steps. 57 steps
  • 100Consistency. Name and required fields are in place
  • 100Progress reporting. Reports progress
  • low 13 top-level sections: this looks like several domains in one skill
  • low The response is described with custom markup (3 tags): a typed call is more reliable

Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.

Quality signals

  • +5Description has no quoted example phrases that should trigger the skill
  • +4Description does not say when NOT to use the skill (false activations)
  • +3Description length 87: 120–800 characters recommended
  • +3Output format is not stated: the model decides each time
  • -223 emoji in the instructions: noise for the model
  • -31 of 13 scripts are never mentioned in SKILL.md
  • +1No license
  • +2Single-language instructions
  • +4Structure: 39 headings
  • +3Step-by-step instructions: 57 items
  • +4Has examples (11 code blocks)
  • +4Reference files are cited in the instructions (2 of 2)

Quality base 70; lint remarks subtract, signals add up to 100. Result: 41.

External checks

ClawHub: clean
This skill appears to do what it says: automate A-share market reports and send them to WeCom, with some credential-handling and data-source caveats to review.
LLM: benign (high) · VirusTotal: · 20 Jun 2026