Back to skill
Skillv1.3.0
ClawScan security
Vegas T Trading · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 20, 2026, 4:13 PM
- Verdict
- Benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill appears to implement the described intra-day trading analysis (EMA + Fibonacci + multi-period scoring) and only requires running the included Python script and fetching market data; nothing requested is disproportionate to that purpose.
- Guidance
- This package is coherent with its stated trading-analysis purpose, but exercise normal caution before running code from an unknown author: 1) Review scripts/vegas_analyzer.py fully (the posted content was truncated) to confirm there are no unexpected network endpoints, credential uses, or code that executes trades. 2) Expect the script to perform network requests (AKShare, possibly Binance) for market data—run it in a network-monitored or sandboxed environment if you are concerned. 3) Install dependencies from trusted sources and consider pinning versions (pip install akshare pandas). 4) The tool provides analysis only—it should not, based on the provided materials, execute trades or require API keys; if you plan to connect any broker/exchange APIs, do not supply keys unless you trust and have audited the code. 5) If you want higher assurance, ask the author for a complete code listing or run a full static review before use.
Review Dimensions
- Purpose & Capability
- okName/description (Vegas Tunnel trading analysis) align with the included files and runtime instructions: the Python analyzer implements EMA, Fibonacci and multi-period scoring and the SKILL.md explains how to run it. Required dependencies (akshare, pandas) are consistent with fetching market data and processing time series.
- Instruction Scope
- noteSKILL.md instructs the agent/user to run the included Python script which will fetch market data (AKShare, and for crypto it references Binance network access). The instructions do not ask the agent to read unrelated system files or secrets. Note: executing the script will perform network requests to pull market data.
- Install Mechanism
- okNo install spec; code files are bundled with the skill. Dependency installation is user-side via pip (akshare, pandas). No downloads from arbitrary URLs or extract steps are present in the package metadata.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths. The behavior described (market-data fetching) does not require API keys for public price data. No evidence of requests for unrelated secrets.
- Persistence & Privilege
- okalways is false and the skill does not request persistent system-wide privileges. It does not attempt to modify other skills or global agent configuration in the provided materials.