ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Einstein Research — Edge Candidate Generator

v0.1.0

Generate and prioritize US equity long-side edge research tickets from EOD observations, then export pipeline-ready candidate specs for trade-strategy-pipeli...

⭐ 0· 58·0 current·0 all-time
byRunByDaVinci@clawdiri-ai
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
ℹ
Purpose & Capability
The repository's code and README implement auto-detection, ticket structuring, validation, and export to a pipeline spec, which aligns with the skill description. However, SKILL.md examples use an 'edge-generator' CLI (create/prioritize/export) that does not exist in the provided files; the actual scripts are named auto_detect_candidates.py, export_candidate.py, validate_candidate.py, etc. That naming mismatch is an inconsistency the user should notice — it could be harmless (documentation drift) or indicate the skill expects a wrapper/alias not bundled here.
!
Instruction Scope
SKILL.md instructs running an 'edge-generator' CLI which is not present in the code bundle; an agent following the SKILL.md could attempt to run commands that don't exist. The actual scripts do perform file IO (read/write tickets and strategy dirs) and call subprocess.run to invoke external commands (LLM CLI via --llm-ideas-cmd and the pipeline validator via 'uv run' or similar). Those subprocess calls will execute arbitrary user-provided commands and parse their stdout — this is expected for integration but expands the runtime scope and risk if untrusted command strings are provided.
ℹ
Install Mechanism
There is no install spec (instruction-only from registry perspective) which reduces supply-chain risk. The README suggests Python dependencies (PyYAML, pandas). Because no packaging/install steps are provided, a user or agent must install Python deps and invoke scripts directly; this is reasonable but means the agent will rely on local environment state that may vary.
✓
Credentials
The skill declares no required environment variables, credentials, or config paths. That is proportional to the stated purpose. Caveat: several scripts accept/execute external commands (LLM CLI and 'uv' for pipeline validation) and will run whatever command the user supplies; this does not require secrets by default, but it does create an execution surface for arbitrary commands if misconfigured.
✓
Persistence & Privilege
The skill is not always-included and does not request privileged persistence. It writes candidate artifacts to user-specified directories (strategies/, tickets/), which is normal for this functionality and limited in scope. It does not attempt to modify other skills or system-wide agent configuration.
What to consider before installing
What to check before installing or running this skill: - Confirm the CLI you expect: SKILL.md shows an 'edge-generator' CLI (create/prioritize/export) but the package provides Python scripts (auto_detect_candidates.py, export_candidate.py, validate_candidate.py). Either the README/skill documentation is out of date or a wrapper is missing. Do not run commands shown in SKILL.md unless you verify an appropriate executable is present. - Inspect subprocess usage: auto_detect_candidates.py and validate_candidate.py call subprocess.run to execute external programs (LLM CLI commands and the pipeline 'uv' validator). Only supply trusted command strings and run these scripts in an isolated environment, because subprocess.run will execute whatever command is passed. - Run tests and lint locally in a sandbox: the bundle includes unit tests; run them in a disposable environment (virtualenv/container) to validate behavior before using on real data. - Review I/O paths: the scripts read/write tickets, strategies, and metadata under folders like tickets/, strategies/, and any pipeline-root you provide. Ensure the output paths are safe and not shared with sensitive repos or production directories. - Dependency installation: install Python deps (PyYAML, pandas) in a controlled environment rather than system-wide. - If you want to use this skill with an agent, either: - create or verify a wrapper 'edge-generator' that maps to these scripts, or - update the SKILL.md to call the actual scripts, and ensure the agent will not be given arbitrary command strings to run. - If you lack the ability to audit code, avoid giving this skill autonomous invocation in sensitive contexts and do not provide untrusted commands for the LLM CLI or pipeline validator. If you want, I can list the exact places in the code where subprocess.run is used and the arguments it accepts so you can review them specifically.

Like a lobster shell, security has layers — review code before you run it.

latestvk974pfev7bd7mvbag5rqryjxrd83cfmz

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments