Skillv1.0.0

ClawScan security

sector-rotation · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 17, 2026, 7:53 AM

Verdict: Benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only trading guidance skill about sector rotation; its required resources and instructions are consistent with its stated purpose and it does not request credentials or install code.
Guidance: This skill is an instruction-only reference for sector-rotation trading and is internally coherent. It does not request credentials or install code, so the immediate technical risk is low. However: (1) trading guidance is not financial advice—verify signals and backtest before acting; (2) if you connect this agent to broker APIs or give it the ability to execute orders, review those connectors carefully (this skill itself doesn't request credentials but an agent with trading integrations could act on its recommendations); (3) if you expect real-time market data, ensure the data sources and API keys used by the agent are trusted. If you want higher assurance, ask the publisher for provenance (who authored it) and for any backtest/results supporting the rules.

Purpose & Capability: okName and description match the content: the files contain sector-rotation theory, signal rules, and timing guidelines. There are no unrelated environment variables, binaries, or external services requested.
Instruction Scope: okSKILL.md contains static strategy guidance and short actionable rules (e.g., multi-day ranking, fund inflow, number of limit-up stocks). It does not instruct the agent to read system files, access environment variables, or post data to external endpoints.
Install Mechanism: okNo install spec or code files are present (instruction-only). Nothing will be downloaded or written to disk by the skill itself.
Credentials: okThe skill declares no required environment variables, credentials, or config paths; nothing requested appears disproportionate to a trading-strategy reference.
Persistence & Privilege: okalways is false and the skill does not request persistent system privileges or modify other skills. It is user-invocable and can be called by the agent when relevant, which is expected for skills.