OpenClaw/clawhub-security-signals huggingface dataset:
Skill: kiril-shturman/coo-commander (version 1.0.0)

--- name: coo-commander description: Startup-style COO / commander role for orchestrating missions across one or more worker agents. Use when an agent must accept a business goal, break it into ordered tasks, assign work, request status updates, detect blockers, decide next steps, and close the mission without doing the heavy execution itself. Triggers on requests for orchestrator, commander, manager, chief of staff, mission control, agent coordination, status checks, task routing, or startup team leadership. --- Act as the COO / commander, not the heavy worker. ## Core job - Accept a mission from the founder/operator. - Rewrite it into a concrete objective. - Break it into small ordered tasks. - Assign the next task to the worker. - Ask for status on a fixed cadence or at logical checkpoints. - Detect blockers and decide whether to clarify, reassign, or escalate. - Close the mission with a concise summary and next step. ## Never do these - Do not perform deep research if a worker can do it. - Do not write the full artifact unless the user explicitly asks for a commander-only answer. - Do not code, implement, or do long-form execution if a worker is available. - Do not produce long rambling analysis. - Do not start multiple independent threads at once unless the mission clearly requires it. ## Message protocol Use short, structured blocks. Prefer one of these headings: - MISSION START - TASK - STATUS CHECK - BLOCKER - NEXT ORDER - MISSION COMPLETE ## Output rules - Keep messages compact and operational. - Always state owner, deliverable, and next action. - When assigning work, specify exactly one clear deliverable. - When checking status, ask for progress, blocker, and ETA. - When closing, summarize what was done, what remains, and what to do next. ## Working pattern 1. Restate the mission. 2. Split into 3-7 steps. 3. Assign step 1. 4. Wait for result or status. 5. Issue next order. 6. Repeat until mission is done. 7. Publish completion summary. ## Good commander style - Crisp. - Decisive. - Operational. - Focused on momentum. - Ruthless about clarity. ## Bad commander style - Doing the work personally. - Re-explaining the entire mission every turn. - Asking vague questions. - Letting blockers sit unresolved. - Producing essay-length updates.

path: LICENSE.txt
content: Publisher confirms they have the right to publish this skill and accept the applicable ClawHub publication terms.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: jpengcheng523-netizen/jpeng-file-converter (version 1.0.0)

--- name: jpeng-file-converter description: "File format conversion skill. Convert between PDF, DOCX, Markdown, HTML, images, audio, and video formats." version: "1.0.0" author: "jpeng" tags: ["file", "convert", "pdf", "docx", "markdown", "image", "audio", "video"] --- # File Converter Convert files between different formats. ## When to Use - User wants to convert a file to another format - Convert documents (PDF, DOCX, Markdown) - Convert images (PNG, JPG, WebP, SVG) - Convert audio/video formats ## Supported Conversions ### Documents - PDF ↔ DOCX - Markdown ↔ HTML ↔ PDF - TXT ↔ DOCX ### Images - PNG ↔ JPG ↔ WebP ↔ GIF - SVG → PNG/JPG - HEIC → JPG/PNG ### Audio - MP3 ↔ WAV ↔ FLAC ↔ AAC - M4A ↔ MP3 ### Video - MP4 ↔ WebM ↔ AVI - Video → GIF ## Usage ### Convert document ```bash python3 scripts/convert.py \ --input ./document.docx \ --output ./document.pdf ``` ### Convert image ```bash python3 scripts/convert.py \ --input ./image.png \ --output ./image.jpg \ --quality 90 ``` ### Batch convert ```bash python3 scripts/convert.py \ --input-dir ./images/ \ --output-dir ./converted/ \ --from png \ --to webp ``` ### Resize image ```bash python3 scripts/convert.py \ --input ./photo.jpg \ --output ./thumbnail.jpg \ --resize 800x600 ``` ### Extract audio from video ```bash python3 scripts/convert.py \ --input ./video.mp4 \ --output ./audio.mp3 \ --extract-audio ``` ## Output ```json { "success": true, "input": "./document.docx", "output": "./document.pdf", "input_size_kb": 45, "output_size_kb": 52 } ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: extraterrest/auto-rollback (version 1.2.0-alpha.2)

--- name: auto-rollback description: Timed rollback safety net for edits to ~/.openclaw/openclaw.json on macOS. Use when changing Gateway config, restarting Gateway after config edits, or needing backup + auto-restore protection via launchd and BOOT.md health-check cancellation. license: MIT metadata: { "openclaw": { "emoji": "🛡️", "os": ["darwin"], "requires": { "bins": ["bash", "launchctl", "jq", "curl", "plutil"] } } } --- # Auto-Rollback Use this skill before editing `~/.openclaw/openclaw.json`. It creates a timestamped backup, schedules a rollback job for 10 minutes later, and restores the backup if Gateway still cannot come up. Rollback auto-cancellation is available only if the workspace `BOOT.md` includes the bundled snippet from this skill and the `boot-md` hook is already installed. ## Quick Flow 1. Run `skills/auto-rollback/auto-rollback.sh start --reason "what changed"` 2. Edit `~/.openclaw/openclaw.json` 3. Restart Gateway 4. If Gateway becomes healthy, `BOOT.md` cancels the rollback 5. If Gateway stays unhealthy, launchd executes the rollback script ## Commands ### Start protection ```bash skills/auto-rollback/auto-rollback.sh start --reason "update gateway bindings" ``` Short form also works: ```bash skills/auto-rollback/auto-rollback.sh start "update gateway bindings" ``` ### Cancel pending rollback ```bash skills/auto-rollback/auto-rollback.sh cancel ``` ### Inspect current state ```bash skills/auto-rollback/auto-rollback.sh status ``` ## BOOT.md Integration This skill does not install the `boot-md` hook by itself. To enable automatic cancellation after a healthy restart: 1. Ensure your OpenClaw workspace already has the `boot-md` hook installed. 2. Merge `skills/auto-rollback/BOOT.md` into the workspace root `BOOT.md`. Without that integration, rollback still works, but you must cancel it manually after a successful restart. ## Files - Script: `skills/auto-rollback/auto-rollback.sh` - BOOT snippet: `skills/auto-rollback/BOOT.md` - Backups: `~/.openclaw/openclaw.json.YYYYMMDD-HHMMSS` - State: `~/.openclaw/state/rollback-pending.json` - Log: `~/.openclaw/logs/rollback.log` - launchd plist: `~/.openclaw/ai.openclaw.rollback.plist` ## Agent Rule If you want agents to always use this safety net, add an SOP rule in `AGENTS.md` that any `openclaw.json` change must run `start` first.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)
Skill: artyomx33/first-principles-decomposer (version 1.0.0)

--- name: first-principles-decomposer description: Break any problem down to fundamental truths, then rebuild solutions from atoms up. Use when user says "firstp", "first principles", "from scratch", "what are we assuming", "break this down", "atomic", "fundamental truth", "physics thinking", "Elon method", "bedrock", "ground up", "core problem", "strip away", or challenges assumptions about how things are done. --- # First Principles Decomposer ## When To Use - Designing new products or features - Feeling stuck on a complex problem - Existing solutions seem overcomplicated - Need to challenge assumptions - Starting any new project or initiative ## The Process ### Phase 1: Identify Assumptions Ask: "What am I assuming to be true that might not be?" List every assumption embedded in the current approach. ### Phase 2: Break to Atoms For each assumption, ask: "What is the most fundamental truth here?" Keep asking "why?" until you hit bedrock facts. ### Phase 3: Rebuild From Truth Starting ONLY from verified fundamentals, ask: "What's the simplest solution that addresses the core need?" ## Interactive Flow When user invokes this skill: 1. **Clarify the problem** (1-2 questions max) 2. **Surface assumptions** - list what's being taken for granted 3. **Decompose to fundamentals** - show the atomic truths 4. **Rebuild solution** - construct from ground up 5. **Compare** - show how this differs from conventional approach ## Output Format ``` PROBLEM: [stated problem] ASSUMPTIONS IDENTIFIED: 1. [assumption] → Challenge: [why this might be wrong] 2. [assumption] → Challenge: [why this might be wrong] FUNDAMENTAL TRUTHS: • [bedrock fact 1] • [bedrock fact 2] • [bedrock fact 3] REBUILT SOLUTION: [New approach built only from fundamentals] VS CONVENTIONAL: [How this differs from the obvious approach] ``` ## Example Triggers - "Break down our parent communication problem from first principles" - "I want to rethink how we do [X] from the ground up" - "What are we assuming about [problem] that might be wrong?" ## Integration This skill compounds with: - **inversion-strategist** - After rebuilding from fundamentals, invert to find what would guarantee failure of the new approach - **second-order-consequences** - Project downstream effects of implementing the rebuilt solution - **pre-mortem-analyst** - Stress-test the rebuilt solution by imagining its failure - **six-thinking-hats** - Apply all six perspectives to validate each fundamental truth identified ## Skill Metadata **Created**: 2026-01-06 **Last Updated**: 2026-01-06 **Author**: Artem **Version**: 1.0 --- See references/framework.md for detailed methodology See references/examples.md for Artem-specific examples See references/integrated-frameworks.md for Stanford Design Thinking + MIT Systems Engineering combo


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: teoslayer/pilot-receipt (version 1.0.0)

--- name: pilot-receipt description: > Delivery and read receipts for messages over the Pilot Protocol network. Use this skill when: 1. You need confirmation that messages were delivered 2. You want to track when recipients read your messages 3. You need audit trails for message delivery Do NOT use this skill when: - You need anonymous messaging (use pilot-chat without receipts) - You're sending fire-and-forget messages (use pilot-broadcast) - Receipt tracking adds unnecessary overhead tags: - pilot-protocol - communication - receipts - tracking license: AGPL-3.0 compatibility: > Requires pilot-protocol skill and pilotctl binary on PATH. The daemon must be running (pilotctl daemon start). metadata: author: vulture-labs version: "1.0" openclaw: requires: bins: - pilotctl homepage: https://pilotprotocol.network allowed-tools: - Bash --- # pilot-receipt Delivery and read receipts for messages over the Pilot Protocol network. This skill enables tracking of message delivery status and read confirmation, providing visibility into whether recipients have received and opened your messages. ## Commands ### Send with Receipts Send message with metadata to track delivery: ```bash pilotctl --json send-message <hostname> --data "<message>" ``` ### Check Inbox Check received messages (receipts in metadata): ```bash pilotctl --json inbox ``` Clear inbox after reading: ```bash pilotctl --json inbox --clear ``` ### Subscribe to Topic Subscribe to receipt channel for notifications: ```bash pilotctl --json subscribe <hostname> receipts ``` ### Publish Receipt Publish read receipt confirmation: ```bash pilotctl --json publish <hostname> receipts --data "{\"message_id\":\"123\",\"read_at\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"}" ``` ## Workflow Example ```bash #!/bin/bash # Send message and track delivery/read status RECIPIENT="agent-b" MESSAGE="Please confirm receipt of this critical update" MESSAGE_ID=$(date +%s) # Send message with ID pilotctl --json send-message "$RECIPIENT" --data "{\"id\":\"$MESSAGE_ID\",\"text\":\"$MESSAGE\"}" echo "Message sent: $MESSAGE_ID" echo "Subscribing to receipt channel..." # Subscribe to receipt channel pilotctl --json subscribe "$RECIPIENT" receipts --count 1 | while read -r receipt; do RECEIVED_ID=$(echo "$receipt" | jq -r '.message_id') READ_AT=$(echo "$receipt" | jq -r '.read_at') if [ "$RECEIVED_ID" = "$MESSAGE_ID" ]; then echo "Message read at $READ_AT" break fi done & SUB_PID=$! # Wait for receipt sleep 60 if kill -0 $SUB_PID 2>/dev/null; then kill $SUB_PID echo "Warning: No read receipt received" else echo "Receipt confirmed" fi ``` ## Dependencies Requires pilot-protocol, pilotctl, jq. Receipt mechanism uses pub/sub and message metadata.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: albionaiinc-del/logvance (version 1.0.0)

# Logvance Converts UTC or ISO-formatted timestamps in log files to local system time, making log analysis faster and more intuitive for developers and sysadmins. ## Usage ```bash # Process a log file python logvance.py app.log # Pipe logs directly journalctl -u myservice | python logvance.py # Save to output file python logvance.py server.log -o local_time.log ``` ## Price $2.50


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: clawzai/bnb-chain (version 0.1.0)

--- name: bnb-chain version: 0.1.0 description: Basic BNB Chain operations — check balances, send BNB, send BEP-20 tokens. metadata: {"openclaw":{"emoji":"🟡","category":"blockchain","requires":{"bins":["node"]}}} --- # BNB Chain Skill Basic operations on BNB Chain (BSC). Check balances and send transactions. ## Setup Requires Node.js and ethers.js: ```bash cd ~/.openclaw/workspace/skills/bnb-chain && npm install ethers --silent ``` ## Configuration Store your private key securely. The skill reads from environment variable: ```bash export BNB_PRIVATE_KEY="0x..." ``` Or pass it directly to the helper script. ## Usage All operations use the helper script: `bnb.js` ### Check BNB Balance ```bash node bnb.js balance <address> ``` Example: ```bash node bnb.js balance 0x9787436458A36a9CC72364BaC18ba78fdEf83997 ``` ### Check BEP-20 Token Balance ```bash node bnb.js token-balance <token_address> <wallet_address> ``` Example (USDT): ```bash node bnb.js token-balance 0x55d398326f99059fF775485246999027B3197955 0x9787436458A36a9CC72364BaC18ba78fdEf83997 ``` ### Send BNB ```bash node bnb.js send <to_address> <amount_bnb> [--key <private_key>] ``` Example: ```bash node bnb.js send 0xRecipient 0.01 --key 0xYourPrivateKey ``` ### Send BEP-20 Token ```bash node bnb.js send-token <token_address> <to_address> <amount> [--key <private_key>] ``` Example (send 10 USDT): ```bash node bnb.js send-token 0x55d398326f99059fF775485246999027B3197955 0xRecipient 10 --key 0xYourPrivateKey ``` ### Get Wallet Address from Private Key ```bash node bnb.js address <private_key> ``` ### Get Transaction Details ```bash node bnb.js tx <tx_hash> ``` ## Common Token Addresses (BSC Mainnet) | Token | Address | |-------|---------| | USDT | [REDACTED_SECRET] | | USDC | [REDACTED_SECRET] | | BUSD | [REDACTED_SECRET] | | WBNB | [REDACTED_SECRET] | ## RPC Endpoints Default: `https://bsc-dataseed.binance.org/` Alternatives: - `https://bsc-dataseed1.binance.org/` - `https://bsc-dataseed2.binance.org/` - `https://bsc-dataseed3.binance.org/` - `https://bsc-dataseed4.binance.org/` ## Security Notes - **Never commit private keys** to git - Use environment variables or secure storage - Double-check recipient addresses before sending - Start with small test amounts


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: ruslanlanket/avito (version 1.0.0)

--- name: avito description: Manage Avito.ru account, items, and messenger via API. Use for listing items, checking balance, reading chats, and getting account info. --- # Avito This skill provides tools to interact with the Avito.ru API. ## Requirements - `requests` library for Python. - Avito Client ID and Client Secret. ## Setup Set your credentials in your environment or provide them when prompted. ## Features ### Authentication Get an access token using your client credentials. ```bash python3 scripts/auth.py <client_id> <client_secret> ``` ### Account Info Get information about your account, including your `user_id`. ```bash python3 scripts/get_self.py <token> ``` ### Balance Check your account balance. ```bash python3 scripts/get_balance.py <token> <user_id> ``` ### Items Management List your current advertisements. ```bash python3 scripts/list_items.py <token> ``` ### Messenger List chats in your account. ```bash python3 scripts/list_chats.py <token> <user_id> ``` *Note: Messenger API access may require a specific Avito subscription.* ## TODO - Implement item creation (POST /items). - Implement item status updates (editing, deleting). - Implement webhook registration. - Implement messenger message sending and retrieval.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: ivangdavila/typescript (version 1.0.2)

--- name: TypeScript slug: typescript version: 1.0.2 description: Write type-safe TypeScript with proper narrowing, inference patterns, and strict mode best practices. --- ## When to Use User needs TypeScript expertise — from basic typing to advanced generics. Agent handles type narrowing, inference, discriminated unions, and strict mode patterns. ## Quick Reference | Topic | File | |-------|------| | Generic patterns | `generics.md` | | Utility types | `utility-types.md` | | Declaration files | `declarations.md` | | Migration from JS | `migration.md` | ## Stop Using `any` - `unknown` forces you to narrow before use — `any` silently breaks type safety - API responses: type them or use `unknown`, never `any` - When you don't know the type, that's `unknown`, not `any` ## Narrowing Failures - `filter(Boolean)` doesn't narrow — use `.filter((x): x is T => Boolean(x))` - `Object.keys(obj)` returns `string[]`, not `keyof typeof obj` — intentional, objects can have extra keys - `Array.isArray()` narrows to `any[]` — may need assertion for element type - `in` operator narrows but only if property is in exactly one branch of union ## Literal Type Traps - `let x = "hello"` is `string` — use `const` or `as const` for literal type - Object properties widen: `{ status: "ok" }` has `status: string` — use `as const` or type annotation - Function return types widen — annotate explicitly for literal returns ## Inference Limits - Callbacks lose inference in some array methods — annotate parameter when TS guesses wrong - Generic functions need usage to infer — `fn<T>()` can't infer, pass a value or annotate - Nested generics often fail — break into steps with explicit types ## Discriminated Unions - Add a literal `type` or `kind` field to each variant — enables exhaustive switch - Exhaustive check: `default: const _never: never = x` — compile error if case missed - Don't mix discriminated with optional properties — breaks narrowing ## `satisfies` vs Type Annotation - `const x: Type = val` widens to Type — loses literal info - `const x = val satisfies Type` keeps literal, checks compatibility — prefer for config objects ## Strict Null Handling - Optional chaining `?.` returns `undefined`, not `null` — matters for APIs expecting `null` - `??` only catches `null`/`undefined` — `||` catches all falsy including `0` and `""` - Non-null `!` should be last resort — prefer narrowing or early return ## Module Boundaries - `import type` for type-only imports — stripped at runtime, avoids bundler issues - Re-exporting types: `export type { X }` — prevents accidental runtime dependency - `.d.ts` augmentation: use `declare module` with exact module path


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: smseow001/china-stock-market (version 1.0.0)

--- name: china-stock-market version: 1.0.0 description: 中国股票市场完全指南 - A股、主板、科创板、创业板、北交所交易规则、术语解释、投资风格、风险提示。应用于投资理财、量化交易、宏观分析。 keywords: [中国股市,A股,沪深股市,上证指数,深证成指,创业板,科创板,北交所,股票交易,打新,北向资金,ETF,融资融券] --- # 中国股票市场完全指南 中国股票市场是由**上海证券交易所、深圳证券交易所、北京证券交易所**构成的核心资本市场。 --- ## 一、三大交易所 | 交易所 | 简称 | 主板 | 特点 | |--------|------|------|------| | 上海证券交易所 | 上交所 | 主板 | 大型国企、蓝筹股 | | 深圳证券交易所 | 深交所 | 主板、创业板 | 中小企业、创新企业 | | 北京证券交易所 | 北交所 | 新三板精选层 | 专精特新中小企业 | --- ## 二、主要板块 ### 主板 - **上市条件**：连续盈利3年，注册资本≥5000万元 - **投资者门槛**：无特殊要求 - **涨跌幅**：±10%（ST股±5%） ### 创业板（深交所） - **定位**：创新型企业、成长型公司 - **上市条件**：未盈利企业可上市（注册制） - **投资者门槛**：需开通创业板权限（2年经验+10万资产） - **涨跌幅**：±20% ### 科创板（上交所） - **定位**：硬科技企业（新一代信息技术、高端装备等） - **上市条件**：注册制，未盈利可上市 - **投资者门槛**：需开通科创板权限（2年经验+50万资产） - **涨跌幅**：±20% ### 北交所 - **定位**：专精特新中小企业 - **上市条件**：新三板精选层满一年 - **投资者门槛**：需开通北交所权限（2年经验+50万资产） - **涨跌幅**：±30%（上市首日无限制） --- ## 三、核心术语 ### 常见指数 | 指数 | 简称 | 含义 | |------|------|------| | 上证指数 | 沪指 | 上交所全部股票 | | 深证成指 | 深指 | 深交所精选500股 | | 创业板指 | 创业板 | 创业板100只成分股 | | 科创50 | 科创 | 科创板50只成分股 | | 沪深300 | 沪深300 | 两市最大300只 | ### 交易术语 | 术语 | 含义 | |------|------| | **T+1** | 当日买入，次日才能卖出 | | **T+0** | 当日可买卖（A股不适用，ETF/可转债可） | | **涨停/跌停** | 当日最高/最低涨幅限制 | | **集合竞价** | 9:15-9:25申报，9:25成交 | | **连续竞价** | 9:30-11:30，13:00-15:00 | | **龙虎榜** | 每日涨跌幅前5营业部席位 | | **北向资金** | 外资通过沪股通/深股通买入 | | **融资融券** | 借钱买股（融资）/借股卖出（融券） | | **ETF** | 交易型开放式指数基金 | | **打新** | 申购新股 | ### 特殊标记 | 标记 | 含义 | |------|------| | ST | 特殊处理（连续亏损） | | \*ST | 退市风险警示 | | N | 新股上市首日 | | C | 上市次日至第五日 | --- ## 四、交易规则 ### 交易时间 ``` 上午：9:30 - 11:30 下午：13:00 - 15:00 集合竞价：9:15-9:25（可申报可撤单） 收盘竞价：14:57-15:00 ``` ### 委托规则 - **最小申报单位**：100股（1手） - **申报价格**：±10%（ST ±5%，科创/创业/北交 ±20%） - **当日有效**：未成交委托当日收盘自动失效 ### ST/\*ST规则 - 连续2年亏损 → ST - 连续3年亏损或净资产<1元 → \*ST（退市风险） - 主板ST涨跌幅 ±5% --- ## 五、影响股市的因素 ### 政策面 - 货币政策（降准、降息） - 财政政策（基建、消费刺激） - 监管政策（IPO节奏、注册制改革） - 行业政策（新能源补贴、互联网监管） ### 资金面 - 北向资金（外资流向） - 主力资金（机构动向） - 融资融券余额 - 居民存款搬家 ### 基本面 - 企业盈利（净利润增速） - 宏观经济（GDP、CPI、PPI） - 行业周期 ### 技术面 - 均线系统（MA5/MA10/MA20） - MACD指标 - KDJ指标 - 成交量 ### 外围市场 - 美联储政策（加息/降息） - 美股港股走势 - 汇率（人民币升值利好A股） --- ## 六、投资风格 | 风格 | 特点 | 适合人群 | |------|------|---------| | **价值投资** | 低估值、高股息、长期持有 | 稳健型 | | **成长投资** | 高增长、创业板/科创板 | 进取型 | | **趋势交易** | 追涨杀跌、技术分析 | 短线操作 | | **量化交易** | 数学模型、程序化下单 | 专业投资者 | | **指数基金** | 被动跟踪、费率低 | 普通投资者 | --- ## 七、风险提示 ⚠️ **重要提醒**： 1. **波动风险**：A股政策敏感，波动较大 2. **流动性风险**：小市值股票可能卖不出 3. **退市风险**：注册制下退市加速 4. **杠杆风险**：融资融券放大亏损 5. **政策风险**：监管政策变化影响大 **投资适当性**：股票投资适合风险承受能力较强的投资者，不构成投资建议。 --- ## 八、常见问答 **Q: 怎么开户？** A: 证券公司（华泰、中信、招商等）手机APP线上开户，需准备身份证、银行卡。 **Q: A股和港股有什么区别？** A: A股使用人民币，在境内交易；港股使用港币，在香港交易。A股有涨跌幅限制（T+1），港股无涨跌幅（T+0）。 **Q: 北向资金是什么？** A: 境外投资者通过沪股通、深股通买入A股的资金，反映外资对A股的态度。 **Q: 打新需要什么条件？** A: A股打新需要：有股票账户、有对应市场持仓市值（T-2日前20个交易日）、沪市/深市市值分开计算。 **Q: ETF和股票有什么区别？** A: ETF是一篮子股票的基金，可以像股票一样交易，但日内可T+0（多数ETF），风险分散，不选股。 --- *投资有风险，入市需谨慎。本内容仅供参考，不构成投资建议。*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)