AI Market Intelligence Agent
PassAudited by ClawScan on May 1, 2026.
Overview
This looks like a benign placeholder report generator, but its documentation mentions API keys, scheduled/agent integrations, and a missing setup script that users should review before relying on it.
This skill appears safe to inspect or run as a local placeholder report generator. Before installing it for real use, confirm that any setup script and config file come from a trusted source, do not add API keys until the implementation is reviewed, and verify any scheduled, email/channel, or agent-spawn integrations.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill may appear more capable than it currently is, so users could over-rely on placeholder reports.
The documentation advertises multi-platform data aggregation, while the provided main.sh only creates a placeholder report. This is not evidence of malicious behavior, but users should not assume the advertised intelligence functions are implemented.
- ✅ 多平台数据聚合（新闻、社交媒体、研究）
Treat this as a template unless real data-source integration is added and reviewed.
Installation may fail, or a user might fetch an unreviewed setup script from elsewhere.
The README instructs running setup.sh, but the provided file manifest does not include setup.sh. This is an incomplete install path rather than direct malicious behavior.
chmod +x main.sh ./setup.sh
Do not run any separately obtained setup.sh unless you review its source and trust its origin.
If users add real API keys, those credentials may grant access to third-party data services.
The configuration example expects API credentials for market data sources. This is purpose-aligned, and the provided code does not hardcode, log, or transmit these keys.
"api_key": "your_key_here"
Use least-privilege, revocable API keys and avoid committing config files containing secrets.
Reports or tasks could be routed to another agent or communication channel if the user follows this integration example.
The README includes a user-directed example that delegates work to another named agent. The provided script does not do this automatically, but the other agent's identity and permissions are not explained.
openclaw spawn --task "Run market intelligence on keyword 'AI agent'" --agent "wecom-dm-zhangyang"
Verify the target agent and its permissions before using spawn or messaging integrations.
If a user later configures scheduling, the skill could run repeatedly and generate reports over time.
The skill documents cron-style recurring monitoring. This is aligned with the market-monitoring purpose, and no scheduler is implemented in the provided code.
`frequency`: 监控频率（cron表达式）
Set explicit schedules, output locations, retention limits, and stop conditions before enabling recurring monitoring.