Query real-time and historical financial data across equities and crypto prices

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Anyone using the skill is authorizing requests against their AISA account, which may affect account usage, billing, quotas, or audit logs depending on the provider.

Why it was flagged

The client reads an API key from the environment and uses it as a bearer token for AISA API requests.

Skill content

self.api_key = api_key or os.environ.get("AISA_API_KEY") ... "Authorization": f"Bearer {self.api_key}"

Recommendation

Use a dedicated, least-privileged AISA API key if available, monitor usage, and revoke or rotate the key if you stop using the skill.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Ticker lists, screening filters, and research interests may reveal parts of a user's portfolio or investment focus to the external API provider.

Why it was flagged

The documented workflows include portfolio-style ticker queries, and the skill sends those query parameters to an external API provider.

Skill content

"Get BTC, ETH prices alongside AAPL, NVDA stock data for my portfolio"

Recommendation

Avoid sending sensitive or uniquely identifying portfolio details unless you are comfortable sharing those queries with the AISA API service.