Investment Portfolio
v4.0.0Track investments with buy/sell records, allocation charts, and P/L analysis. Use when managing a stock or crypto portfolio, rebalancing, or comparing assets.
⭐ 0· 840·3 current·3 all-time
byBytesAgain2@ckchzh
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description align with the included scripts: add/remove/update/list/analysis features are implemented in scripts/script.sh. The declared runtime requirements (bash, python3) are appropriate. Minor mismatch: SKILL.md documents a default data directory of ~/.local/share/investment-portfolio/ while the script defaults to $HOME/.investment-portfolio (PORTFOLIO_DIR override is supported). This is likely a documentation/config inconsistency rather than malicious.
Instruction Scope
SKILL.md and the script operate entirely on local files (holdings.jsonl, history.log) and prompt the user to input prices manually; the script invokes embedded python snippets but they only read/write the DB file and history. No external API/network calls are present in the visible code. The script will create and write files in the user's home directory (un-encrypted JSONL and logs), which is expected for this tool but worth noting for privacy.
Install Mechanism
There is no install spec; this is an instruction-only skill with an included bash script. That is low-risk compared to arbitrary network downloads or package installs.
Credentials
The skill requests no credentials and only an optional PORTFOLIO_DIR environment variable to override the data directory. It uses HOME to locate the default directory. No unrelated secrets or config paths are requested.
Persistence & Privilege
always is false and the skill does not modify other skills or system-wide agent settings. It writes files to its own data directory under the user's home, which is normal for this kind of utility.
Assessment
This skill appears to do what it claims: a local portfolio tracker implemented as a bash script that runs python snippets. Before installing or running: (1) review the full scripts/script.sh yourself (you already have it) to confirm there are no hidden network calls in the truncated portion; (2) note that data is stored unencrypted in your home directory (script defaults to ~/.investment-portfolio unless you set PORTFOLIO_DIR), so do not store sensitive credentials or private data there; (3) if you prefer the SKILL.md path (~/.local/share/...) update PORTFOLIO_DIR or the docs to avoid confusion; (4) ensure you are comfortable executing a shell script that writes files — consider running it in a limited account or container if you want extra isolation.Like a lobster shell, security has layers — review code before you run it.
chinesevk97fs08fvgt3hhkaf958gq342s82q28clatestvk97b17qfhc715av83m6pvfjad9836vz9productivityvk97662qntsvhshm7wka5f58rzn82rdah
License
MIT-0
Free to use, modify, and redistribute. No attribution required.