A股技术分析报告 Skill

The skill directly inserts user-provided stock codes into URLs for `openclaw browser navigate` and `http://...` API calls. Without explicit input validation, a malicious user could craft the stock code to perform Server-Side Request Forgery (SSRF), access arbitrary external or internal resources, or potentially inject malicious parameters into the URL.

openclaw browser navigate https://quote.eastmoney.com/sz{代码}.html, http://push2.eastmoney.com/api/qt/stock/get?secid=0.{代码}&fields=...

The skill generates a report by filling data into a Markdown template (`report-template.md`). If the extracted data (especially from potentially untrusted sources like web pages) is not properly sanitized or escaped before being inserted into the Markdown template, it could lead to Markdown injection in the final report.

按 references/report-template.md 中的结构填充数据，生成完整报告。

The skill includes explicit instructions to avoid data fabrication and to append a legal disclaimer. While these are ethical guidelines, they can also serve to semantically frame the agent's output as benign and reduce human oversight scrutiny, even if underlying processes have vulnerabilities.

不以任何形式编造数据, 报告末尾必须附言："以上内容仅为技术面分析，不构成投资建议。"