Sequoia-X
ReviewAudited by ClawScan on May 10, 2026.
Overview
The skill matches its stock-screening purpose, but it deserves review because it downloads and runs unpinned external code and uses a Feishu bot webhook.
Install only if you trust the referenced GitHub project. Before running, inspect or pin the repository version, consider using a virtual environment, and use a dedicated Feishu bot webhook rather than a broadly privileged or reused secret.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user or agent installing the skill may execute code that changes over time outside the ClawHub-reviewed package.
The installer pulls the actual application from a mutable external GitHub repository and installs dependencies without a lockfile or pinned exact versions, so reviewed skill artifacts do not fully determine what code will run.
git clone https://github.com/sngyai/Sequoia-X.git "$INSTALL_DIR" ... pip install akshare "pydantic-settings>=2.0" "rich>=13.0" "pandas>=2.0" "requests>=2.31" python-dotenv
Pin the repository to a specific commit or release, provide checksums or a lockfile, and declare the external source and dependency requirements clearly.
Running the skill gives the downloaded project normal local Python execution rights under the user's account.
The run script executes main.py from ~/sequoia-x, which is populated by the external GitHub clone rather than by code included in the reviewed skill package.
cd "$INSTALL_DIR" python main.py
Review the cloned repository before first run, prefer an isolated virtual environment, and avoid autonomous execution until the installed code is trusted.
Anyone with the webhook URL may be able to send messages to the associated Feishu group.
The skill requires a Feishu group bot webhook so it can send screening results; this is purpose-aligned, but the webhook is a credential-like secret that can post to the configured group.
FEISHU_WEBHOOK_URL=https://open.feishu.cn/open-apis/bot/v2/hook/your-token-here
Use a dedicated, limited Feishu bot webhook, keep the URL private, and rotate it if it is exposed.