A Stock Morning

• Outcome: Review
• Latest audit: May 29, 2026 at 9:33 PM UTC
• Version:
  1.0.0

Overview

This skill mostly matches its stated market-summary purpose, but it runs an undeclared local search script and sends reports through shell commands, so it should be reviewed before installation.

Review or remove the hard-coded Tavily command before installing, confirm what Feishu target -t . resolves to in your OpenClaw environment, and only add the cron job if you want automatic weekday posts. The skill is not evidence of malware, but its undeclared dependency and shell-based sending make it unsuitable for blind installation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script sends messages by constructing a shell command and passing the generated report into execSync. Although double quotes are escaped, shell metacharacters such as backticks and $() are not neutralized, so untrusted content pulled from external data sources could trigger command substitution when the message is sent.

VirusTotal

64/64 vendors flagged this skill as clean.