Back to skill
Skillv4.0.0
ClawScan security
Investment Portfolio · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 19, 2026, 1:32 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code and instructions match its stated purpose (a local, file-based portfolio tracker); nothing requests unrelated credentials or network access, though it stores data unencrypted in the user's home directory and there's a small documentation/config mismatch to be aware of.
- Guidance
- This skill appears to do what it claims: a local portfolio tracker implemented as a bash script that runs python snippets. Before installing or running: (1) review the full scripts/script.sh yourself (you already have it) to confirm there are no hidden network calls in the truncated portion; (2) note that data is stored unencrypted in your home directory (script defaults to ~/.investment-portfolio unless you set PORTFOLIO_DIR), so do not store sensitive credentials or private data there; (3) if you prefer the SKILL.md path (~/.local/share/...) update PORTFOLIO_DIR or the docs to avoid confusion; (4) ensure you are comfortable executing a shell script that writes files — consider running it in a limited account or container if you want extra isolation.
Review Dimensions
- Purpose & Capability
- noteName/description align with the included scripts: add/remove/update/list/analysis features are implemented in scripts/script.sh. The declared runtime requirements (bash, python3) are appropriate. Minor mismatch: SKILL.md documents a default data directory of ~/.local/share/investment-portfolio/ while the script defaults to $HOME/.investment-portfolio (PORTFOLIO_DIR override is supported). This is likely a documentation/config inconsistency rather than malicious.
- Instruction Scope
- noteSKILL.md and the script operate entirely on local files (holdings.jsonl, history.log) and prompt the user to input prices manually; the script invokes embedded python snippets but they only read/write the DB file and history. No external API/network calls are present in the visible code. The script will create and write files in the user's home directory (un-encrypted JSONL and logs), which is expected for this tool but worth noting for privacy.
- Install Mechanism
- okThere is no install spec; this is an instruction-only skill with an included bash script. That is low-risk compared to arbitrary network downloads or package installs.
- Credentials
- okThe skill requests no credentials and only an optional PORTFOLIO_DIR environment variable to override the data directory. It uses HOME to locate the default directory. No unrelated secrets or config paths are requested.
- Persistence & Privilege
- okalways is false and the skill does not modify other skills or system-wide agent settings. It writes files to its own data directory under the user's home, which is normal for this kind of utility.