Use when the user needs Tonghuashun iFinD market, report, factor, screening, calendar, or other financial data, and all data must come from iFinD after succe...
Security Analysis
high confidenceThe skill's code, instructions and requested secrets are consistent with a Tonghuashun iFinD query wrapper: it requires a user-provided iFinD refresh_token (exchanged for an access_token), uses python3, talks to iFinD endpoints, and only optionally calls an external LLM if explicitly enabled.
Name/description (iFinD natural-language query entry) matches the files and behavior: python CLI and runtime package that call iFinD HTTP endpoints (default base_url quantapi.51ifind.com). Required binary (python3) is appropriate. The skill is not requesting unrelated cloud credentials or unrelated system access.
Runtime instructions explicitly require the user to copy an iFinD refresh_token and use auth-set-refresh-token/auth-set-tokens; queries are always routed to iFinD. This is within scope for the stated purpose. Notable: the skill documents an optional LLM-based router that will send queries to an OpenAI‑compatible service if the operator sets IFIND_ROUTE_LLM_ENABLED and provides an API key — enabling that will transmit user queries (or routing plans) to a third-party LLM. That behavior is documented but is a privacy consideration.
No remote download/install spec is embedded in the registry metadata; the package contains Python scripts to run locally. There are no network-based installers or hidden download URLs in the provided files. The SKILL.md tells the installer to run scripts/install_skill.sh — check that script locally before running it (not provided in the manifest excerpt).
The skill does not request unrelated environment variables and needs only the iFinD tokens (refresh_token/access_token) to function — this is proportional. The optional LLM routing requires an API key (IFIND_ROUTE_LLM_API_KEY / OPENAI_API_KEY) only when explicitly enabled; that env var is not mandatory but will expose queries to a third-party LLM if set. The skill stores tokens locally (~/.openclaw/.../token_state.json) which is expected but means the stored credentials should be protected.
The skill stores token state in a skill-scoped file and does not request always:true or system-wide privileges. It does not modify other skills or system configs. Autonomous invocation is allowed by default but that is platform normal; there is no evidence it force-enables itself.
Guidance
This skill appears to do what it says: a local Python CLI/skill that exchanges an iFinD refresh_token for an access_token and routes natural-language queries to the iFinD API (quantapi.51ifind.com). Before installing or giving tokens: 1) Only provide the iFinD refresh_token if you trust the skill/operator — the refresh_token grants access to your iFinD account and is stored locally in the skill's token_state.json. 2) Do NOT share your iFinD username/password; the skill explicitly asks for refresh_token only. 3) If you enable the optional LLM routing (IFIND_ROUTE_LLM_ENABLED and IFIND_ROUTE_LLM_API_KEY), be aware user queries (or routing plans) will be sent to the configured LLM provider — this may leak sensitive query content. 4) Inspect scripts/install_skill.sh locally before running it and confirm installation path (~/.openclaw/workspace/skills/tonghuashun-ifind-skill). 5) If you need stronger isolation, run the skill in a restricted environment or use an account whose tokens you can revoke. Overall the package is internally coherent with its stated purpose; the primary risk is the sensitive refresh_token and any optional LLM usage, not malicious mismatches.
Latest Release
v0.5.1
修正 ClawHub 发布入口，保留既有 tonghuashun-ifind slug，并继续使用强制 iFinD token 鉴权和自然语言路由。
More by @etherstrings
Published by @etherstrings on ClawHub
