Back to skill
Skillv2.3.4
ClawScan security
Fund Invest Advisor · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 17, 2026, 6:57 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This skill is internally coherent: it implements a local fund-advisor tool (bash + Python) that performs offline calculations and stores portfolio data under the user's data directory; it does not request credentials or contact external endpoints.
- Guidance
- This skill appears to do what it claims: local fund calculations and a simple local portfolio CLI. Before installing/run: (1) Review the scripts yourself if you can — they are plain Bash/Python and readable. (2) Be aware the tool stores data under $XDG_DATA_HOME or $HOME/.local/share/fund-invest-advisor (portfolio.jsonl and history.log); if you care about privacy, inspect or move that directory and back it up. (3) There is no network access or secret exfiltration in the code, but the skill is not a substitute for professional financial advice — double-check calculations and assumptions before acting on them. (4) Note small packaging inconsistencies (two scripts, metadata homepage/source mismatch); these are not malicious but you may want the publisher/source verified if provenance matters.
Review Dimensions
- Purpose & Capability
- noteThe name/description (fund investment advisor) matches the included code and docs: both scripts implement calculators, allocation and rebalancing suggestions, tips, and a local portfolio store. Minor inconsistencies: registry metadata earlier showed no homepage/source while SKILL.md lists a homepage and GitHub source; and two scripts are present (scripts/fund.sh and scripts/script.sh) with overlapping but different CLIs — not harmful but a slight packaging inconsistency.
- Instruction Scope
- okSKILL.md instructs the agent to run local scripts (scripts/fund.sh). The scripts perform only local computation, print guidance, and read/write portfolio files under a user data directory. The instructions do not reference or attempt to read unrelated system files, secrets, or network endpoints. They do create and use persistent local files for portfolio/history.
- Install Mechanism
- okThis is an instruction-only skill with included scripts (no install spec). No remote downloads or package installs are performed by the skill bundle itself, so there is no elevated install risk.
- Credentials
- okThe skill requires standard shells and Python (documented). It does not request environment variables or secrets. It optionally respects FUND_DIR / XDG_DATA_HOME / HOME to determine its data directory (expected for a CLI that stores data). No unrelated credentials or sensitive env vars are requested.
- Persistence & Privilege
- noteThe scripts create and write to a data directory (default: $XDG_DATA_HOME or $HOME/.local/share/fund-invest-advisor), a portfolio JSONL file, and a history.log. This is a normal behavior for a local portfolio tool but does mean the skill will persist user data on disk. always:false (not force-included) and no elevated privileges are requested.