Japanfinance Agent

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: japanfinance-agent Version: 0.1.2 The skill bundle describes a legitimate-appearing financial data aggregator for Japanese markets (EDINET, TDNET, e-Stat, etc.). The SKILL.md and _meta.json files contain standard installation instructions via 'uv' and 'pip', CLI usage examples, and documentation for handling API credentials required by the data providers. No malicious code, exfiltration patterns, or prompt injection attempts were found.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteMedium Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill will install and run code from an external package that was not visible in these artifacts.

Why it was flagged

The skill depends on an external package that was not included for code review, so installation trust depends on the package source and distribution.

Skill content

uv | package: japanfinance-agent[all] | creates binaries: japanfinance-agent

Recommendation

Install only if you trust the package source; review the package metadata/source if available and consider pinning a known version.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

You may need to provide API keys or login credentials for finance data providers.

Why it was flagged

The skill discloses that some data sources require credentials, which is expected for those integrations but still gives the installed tool account-level access to those services.

Skill content

| EDINET | Securities filings, XBRL financial statements | API key (free) | ... | e-Stat | Government statistics (GDP, CPI, employment) | App ID (free) | ... | J-Quants | Stock prices (OHLCV) | Email + Password |

Recommendation

Use dedicated or least-privilege credentials where possible, and check the provider/package documentation for how credentials are stored and used.

NoteMedium Confidence

ASI07: Insecure Inter-Agent Communication

What this means

If you start the MCP server, connected clients may be able to request financial data through this tool.

Why it was flagged

The skill documents an MCP server mode, which can expose the agent's finance-data tools to MCP clients when the user starts it.

Skill content

### Start MCP server
```bash
japanfinance-agent serve
```

Recommendation

Only run the MCP server in a trusted environment and confirm its binding, authentication, and client permissions in the package documentation.