Skillv1.0.0

ClawScan security

Csi Stock Analyzer · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

SuspiciousMar 13, 2026, 2:08 PM

Verdict: suspicious
Confidence: medium
Model: gpt-5-mini
Summary: The skill generally matches a stock-analysis tool, but its runtime expects third‑party API keys (TAVILY and potentially market-data tokens) and performs external network calls while the registry metadata declares no required environment variables — this mismatch and missing provenance are worth caution.
Guidance: This package appears to implement the advertised stock-analysis features and will call an external news API (api.tavily.com) and optionally market-data services. Before installing: 1) Be aware you must supply a TAVILY_API_KEY (and optionally other market tokens) even though the registry metadata doesn't list it — check README/config.yaml and avoid entering sensitive or unrelated credentials. 2) Review requirements.txt and run in an isolated environment (virtualenv/container) because it installs network-capable libraries (requests, pandas, etc.). 3) Expect the skill to create ./data/cache and ./reports on disk; if you want no external network access, run with include_news=False or don't set the API key. 4) Verify the Tavily service and API key provider you trust; avoid providing high‑privilege secrets. 5) Because source and homepage are unknown, prefer running first in a sandbox, inspect requirements and the few request calls (api.tavily.com) in core/data_fetcher.py, and only then use it with real credentials.

Review Dimensions

Purpose & Capability: noteCode implements real-time/news/technical/financial analysis consistent with the skill description. It uses a news API (api.tavily.com) and placeholders for market-data providers (tushare/akshare). However the registry metadata declares no required env vars/credentials while the code and README expect TAVILY_API_KEY (and optionally TUSHARE_TOKEN/AKSHARE_KEY). That mismatch is unexpected.
Instruction Scope: noteSKILL.md and README show normal usage (call AdvancedStockAnalyzer, run scripts/analyze_stock.py). Runtime instructions and code do not request unrelated system files or broad data collection. They do create/read local cache and write reports under ./data/cache and ./reports. The missing explicit instruction in SKILL.md about required API keys (TAVILY_API_KEY) is a scope/documentation gap.
Install Mechanism: okNo install spec in registry; this is an instruction+code package. Dependencies are standard (requests, pandas, numpy) referenced in requirements.txt and README recommends pip install -r requirements.txt. There are no downloads from untrusted URLs or archive extraction steps in the manifest.
Credentials: concernThe code reads TAVILY_API_KEY via os.getenv and config.yaml references ${TAVILY_API_KEY}; it also mentions optional market-data tokens (TUSHARE_TOKEN, AKSHARE_KEY). Requesting a single news API key is proportionate to the stated functionality, but the registry declared no required env vars — the absence of declared credentials in metadata is an inconsistency that could mislead users. No unrelated secrets (e.g., AWS keys) are requested.
Persistence & Privilege: okSkill is not always-enabled and does not request elevated platform privileges. It writes local cache and report files in relative paths (./data/cache, ./reports) which is expected for this application. It does not modify other skills or global agent settings.