Query real-time and historical financial data across equities and crypto prices

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: openclaw-aisa-finance-stock-equity-crypto-market-price-data-yahoo-finance-coinhacko Version: 1.0.0 The OpenClaw MarketPulse skill bundle is a client for the AIsa financial data API. All network requests are directed to the legitimate API endpoint `https://api.aisa.one`. The skill requires an `AISA_API_KEY` environment variable, which is explicitly declared and handled securely. The Python script (`scripts/market_client.py`) uses standard libraries and its functionality is entirely focused on querying financial data as described. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts in `SKILL.md` or `README.md` that would lead to unauthorized actions by the agent.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anyone using the skill is authorizing requests against their AISA account, which may affect account usage, billing, quotas, or audit logs depending on the provider.

Why it was flagged

The client reads an API key from the environment and uses it as a bearer token for AISA API requests.

Skill content
self.api_key = api_key or os.environ.get("AISA_API_KEY") ... "Authorization": f"Bearer {self.api_key}"
Recommendation

Use a dedicated, least-privileged AISA API key if available, monitor usage, and revoke or rotate the key if you stop using the skill.

What this means

Ticker lists, screening filters, and research interests may reveal parts of a user's portfolio or investment focus to the external API provider.

Why it was flagged

The documented workflows include portfolio-style ticker queries, and the skill sends those query parameters to an external API provider.

Skill content
"Get BTC, ETH prices alongside AAPL, NVDA stock data for my portfolio"
Recommendation

Avoid sending sensitive or uniquely identifying portfolio details unless you are comfortable sharing those queries with the AISA API service.