MarketPulse (Stocks + Crypto Data)
Analysis
MarketPulse appears to be a purpose-aligned market-data skill that queries AIsa’s API using an API key, with no artifact-backed evidence of destructive or deceptive behavior.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
BASE_URL = "https://api.aisa.one/apis/v1" ... urllib.request.urlopen(req, timeout=60)
The skill makes outbound API requests to AIsa to retrieve market data. This is disclosed and central to the stated purpose, but users should understand that their query parameters are sent to that provider.
Source: unknown
The registry metadata does not identify a source repository or verified upstream source. The included artifacts are coherent, but provenance is limited.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
self.api_key = api_key or os.environ.get("AISA_API_KEY") ... "Authorization": f"Bearer {self.api_key}"The client reads an API key from the environment and sends it as a bearer token to the AIsa API. This is expected for the integration and is also disclosed in the skill requirements.