stock-portfolio-zh-aisa

• Risk level: Low
• Analyzed: Apr 18, 2026, 12:58 PM
• Findings: 0
• Version: 1.0.0

Overview

The skill's code, requirements, and SKILL.md are internally consistent for a portfolio tool that queries AISA (LLM-style) for prices and stores portfolios locally, with minor implementation and disclosure caveats.

This skill appears to do what it says: it stores portfolios locally and uses the AISA API (via the provided API key) to fetch prices. Before installing: (1) Confirm you trust the AISA provider because the skill sends tickers and related prompts to their API; (2) Be aware the script uses an LLM-style request to return numeric prices (LLMs can hallucinate values) — consider validating prices against a known market-data source; (3) The code may read optional env vars (AISA_BASE_URL, AISA_MODEL, CLAWDBOT_STATE_DIR) that aren’t listed as required — if you set those, they will affect behavior; (4) Review the Python dependency (openai) and run the script in a sandbox or virtualenv if you want to inspect network calls. If you need tighter privacy, avoid putting sensitive identifiers in portfolios or run a version that queries a trusted market-data API instead of a chat model.