finance

What to check before installing: - Do not export or provide API keys (TWELVEDATA_API_KEY, ALPHAVANTAGE_API_KEY) unless you confirm the code actually uses them; the packaged scripts do not read these env vars today. Avoid putting sensitive keys in your environment for this skill unless you add a provider that needs them and you review the implementation. - Expect the skill to create and write files in your project under .cache/market-tracker (watchlist.json, cached JSON). The SKILL.md metadata mentions .cache/finance but the code uses .cache/market-tracker — verify which path is acceptable for you. - The scripts make outbound network requests to open.er-api.com and to Yahoo via yfinance (which performs HTTP requests). If you run this in a network-restricted environment, allowlist those endpoints or run offline. - Installation requires pip packages (yfinance, pandas, requests). Run in an isolated virtualenv and inspect requirements.txt before pip installing. - If you plan to add paid providers later, review and test any code changes that read API keys; don't paste secrets until you verify the exact code paths that use them. - Overall risk: functionality appears legitimate, but packaging/metadata sloppiness could confuse users and accidentally lead to sharing secrets. If you need higher assurance, request the author fix the metadata inconsistencies and/or provide a minimal README listing exactly which env vars the code reads.