
Research
/Security News
Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers via Malicious Updates
Malicious Chrome and Firefox extensions posed as free VPNs while stealing clipboard data through later extension updates.
tickflow-assist
Advanced tools
面向 A 股投资与盯盘场景的 OpenClaw 智能股票插件,基于 TickFlow API 提供实时监控、收盘后复盘、多维综合分析、关键价位跟踪与告警能力。OpenClaw smart stock plugin for A-share investing and watchlist workflows, powered by TickFlow API for realtime monitoring, post-close review, multi-dimensional analysis, key l
基于 OpenClaw 的 A 股监控与分析插件。它使用 TickFlow 获取行情与财务数据,并可选接入 金十数据 MCP 快讯流,结合 LLM 生成技术面、基本面、资讯面的综合判断,并把结果持久化到本地 LanceDB。
最近更新:v0.3.10 跟进 OpenClaw v2026.5.12:构建口径与 Node 要求同步到新版,告警投递统一走 openclaw message send --json,可选工具补充 toolMetadata.optional,并降低 ClawHub 扫描误报风险。完整发布记录见 https://github.com/robinspt/tickflow-assist/blob/main/CHANGELOG.md。
当前主线最低兼容 OpenClaw v2026.5.2+,本次按 OpenClaw v2026.5.12 SDK / 插件清单口径跟进,并使用 contracts.tools 与 setup.providers[].envVars 等新版插件清单字段。建议 Node >=22.16.0,并以目标 OpenClaw 版本上游要求为准。
在执行社区安装前,建议先确认你已经准备好以下配置:
tickflowApiKey、llmApiKey、llmBaseUrl、llmModelalertChannel、alertTarget、alertAccountmxSearchApiKey、jin10ApiToken其中,configure-openclaw 会把上述配置写入 ~/.openclaw/openclaw.json 的 plugins.entries["tickflow-assist"].config,插件启用后会在本地 databasePath 下持久化 LanceDB 数据,并运行监控 / 日更等后台服务。
如果你不想把密钥写进配置文件,运行时也支持环境变量回退,优先级是 openclaw.json / local.config.json > 环境变量 > 默认值。
常用环境变量:TICKFLOW_ASSIST_TICKFLOW_API_KEY / TICKFLOW_API_KEY、TICKFLOW_ASSIST_LLM_API_KEY / LLM_API_KEY、TICKFLOW_ASSIST_LLM_BASE_URL / LLM_BASE_URL、TICKFLOW_ASSIST_LLM_MODEL / LLM_MODEL、TICKFLOW_ASSIST_MX_SEARCH_API_KEY / MX_SEARCH_API_KEY / MX_APIKEY、TICKFLOW_ASSIST_JIN10_API_TOKEN / JIN10_API_TOKEN。
如果你希望尽量避免把密钥落盘,推荐先把这些变量写进 ~/.openclaw/.env,再运行配置向导补齐非密钥项。
社区安装:
openclaw plugins install tickflow-assist
node ~/.openclaw/extensions/tickflow-assist/dist/dev/tickflow-assist-cli.js configure-openclaw
cd ~/.openclaw/extensions/tickflow-assist/python && uv sync
openclaw plugins enable tickflow-assist
openclaw config validate
openclaw gateway restart
configure-openclaw 会把配置写入 ~/.openclaw/openclaw.json 的 plugins.entries["tickflow-assist"].config。tickflowApiKey、tickflowApiKeyLevel、llmApiKey、llmBaseUrl、llmModel;告警场景再补 alertChannel、alertTarget、alertAccount。~/.openclaw/.env,再运行配置向导补齐非密钥项;如需 PNG 告警卡图片投递,请确认宿主 OpenClaw 的全局 npm 环境可解析 sharp,如需中文正常显示再安装 fontconfig 与 Noto CJK 字体。社区安装后的升级方式:
openclaw plugins update tickflow-assist
openclaw gateway restart
插件正式运行读取:
~/.openclaw/openclaw.json
配置路径:
plugins.entries["tickflow-assist"].config
建议按完整功能显式填写以下字段,不要只填 API Key:
tickflowApiKey、llmApiKey、llmBaseUrl、llmModeldatabasePath、calendarFilealertChannel、alertTarget、alertAccountmxSearchApiKey、jin10ApiToken其中,mxSearchApiKey 用于 mx_search、mx_data、mx_select_stock、东方财富自选同步以及非 Expert 财务链路的 lite 补充;东方财富自选管理接口每日额度 200 次;jin10ApiToken 用于 24 小时金十数据快讯监控;jin10FlashNightAlert 默认 false(开启夜间静默),设为 true 可恢复 24 小时快讯告警;alertTarget、alertAccount 建议在准备启用 test_alert、实时监控告警、金十数据快讯告警和定时通知前一并配好,避免配置不完整导致功能缺失。
如果你使用环境变量,运行时支持以下回退:
tickflowApiUrl:TICKFLOW_ASSIST_TICKFLOW_API_URL / TICKFLOW_API_URLtickflowApiKey:TICKFLOW_ASSIST_TICKFLOW_API_KEY / TICKFLOW_API_KEYtickflowApiKeyLevel:TICKFLOW_ASSIST_TICKFLOW_API_KEY_LEVEL / TICKFLOW_API_KEY_LEVELllmBaseUrl:TICKFLOW_ASSIST_LLM_BASE_URL / LLM_BASE_URLllmApiKey:TICKFLOW_ASSIST_LLM_API_KEY / LLM_API_KEYllmModel:TICKFLOW_ASSIST_LLM_MODEL / LLM_MODELmxSearchApiUrl:TICKFLOW_ASSIST_MX_SEARCH_API_URL / MX_SEARCH_API_URLmxSearchApiKey:TICKFLOW_ASSIST_MX_SEARCH_API_KEY / MX_SEARCH_API_KEY / MX_APIKEYjin10McpUrl:TICKFLOW_ASSIST_JIN10_MCP_URL / JIN10_MCP_URLjin10ApiToken:TICKFLOW_ASSIST_JIN10_API_TOKEN / JIN10_API_TOKENdatabasePath 下持久化 LanceDB 数据。Free 可用日线与实时行情;Starter 起可用标的池,插件会用来做申万行业映射与申万 3 级同业表现;Pro 起可用分钟K;Expert 才走 TickFlow 财务数据,非 Expert 默认回退妙想 lite。sharp:插件本地依赖用于生成 PNG;OpenClaw message send --media 还需要宿主 OpenClaw 全局 npm 环境可解析 sharp,否则图片投递会回退为纯文本。mx_search、mx_data、mx_select_stock、东方财富自选同步与非 Expert 财务链路的 lite 补充。FAQs
面向 A 股投资与盯盘场景的 OpenClaw 智能股票插件,基于 TickFlow API 提供实时监控、收盘后复盘、多维综合分析、关键价位跟踪与告警能力。OpenClaw smart stock plugin for A-share investing and watchlist workflows, powered by TickFlow API for realtime monitoring, post-close review, multi-dimensional analysis, key l
The npm package tickflow-assist receives a total of 51 weekly downloads. As such, tickflow-assist popularity was classified as not popular.
We found that tickflow-assist demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Malicious Chrome and Firefox extensions posed as free VPNs while stealing clipboard data through later extension updates.

Research
/Security News
Miasma Mini Shai-Hulud hits @immobiliarelabs Backstage plugins, targeting GitLab and LDAP auth packages on npm.

Security News
Rolldown paused Rust React Compiler integration after a 5MB binary size increase raised concerns about shipping React-specific code to all Vite users.