Japanfinance Agent

PassAudited by ClawScan on May 10, 2026.

Overview

The skill is coherently described as a Japan finance data aggregator, but users should be aware it installs an external package and may use finance-service credentials.

This skill appears purpose-aligned for Japanese finance data analysis. Before installing, verify that you trust the external `japanfinance-agent` package, understand how any EDINET/e-Stat/J-Quants credentials are stored, and only start the MCP server for trusted clients.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteMedium Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill will install and run code from an external package that was not visible in these artifacts.

Why it was flagged

The skill depends on an external package that was not included for code review, so installation trust depends on the package source and distribution.

Skill content

uv | package: japanfinance-agent[all] | creates binaries: japanfinance-agent

Recommendation

Install only if you trust the package source; review the package metadata/source if available and consider pinning a known version.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

You may need to provide API keys or login credentials for finance data providers.

Why it was flagged

The skill discloses that some data sources require credentials, which is expected for those integrations but still gives the installed tool account-level access to those services.

Skill content

| EDINET | Securities filings, XBRL financial statements | API key (free) | ... | e-Stat | Government statistics (GDP, CPI, employment) | App ID (free) | ... | J-Quants | Stock prices (OHLCV) | Email + Password |

Recommendation

Use dedicated or least-privilege credentials where possible, and check the provider/package documentation for how credentials are stored and used.

NoteMedium Confidence

ASI07: Insecure Inter-Agent Communication

What this means

If you start the MCP server, connected clients may be able to request financial data through this tool.

Why it was flagged

The skill documents an MCP server mode, which can expose the agent's finance-data tools to MCP clients when the user starts it.

Skill content

### Start MCP server
```bash
japanfinance-agent serve
```

Recommendation

Only run the MCP server in a trusted environment and confirm its binding, authentication, and client permissions in the package documentation.