itick-stock-quote

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to be a straightforward stock-quote lookup integration that uses an ITICK API token to call the disclosed itick.org market-data API.

Before installing, make sure you trust the itick.org API service and configure a dedicated ITICK_API_TOKEN. The artifacts show read-only market-data queries, not trading or account-changing actions.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The agent can use the configured ITICK API token to request market-data information from itick.org.

Why it was flagged

The skill requires an API credential and uses it as a token header when calling the disclosed itick.org API endpoints.

Skill content

API Token 通过环境变量 `ITICK_API_TOKEN` 自动注入（由 ClawHub 管理）... -H "token: $ITICK_API_TOKEN"

Recommendation

Use a dedicated ITICK token with only the permissions needed for market-data lookup, and avoid sharing or pasting the token in chat.