FinResearchClaw

• Analyzed: May 14, 2026, 7:51 AM
• Findings: 1
• Version: 0.1.2
• Hash: 0379c9c97baad1ef777bcb906c7725529fef562a16146315d34e0e2899b64d7b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle automates finance research by cloning and executing code from an external GitHub repository (https://github.com/ChipmunkRPA/FinResearchClaw). The scripts scripts/install_or_update.sh and scripts/run_finance_example.sh perform high-risk operations, including fetching remote code and installing it into a Python environment via 'pip install -e .'. While these actions are consistent with the stated purpose in SKILL.md, the inherent risk of executing unverified remote code constitutes a significant attack surface for remote code execution (RCE).