ClawWatch

Track, manage, and get price alerts for crypto and stocks, view market overviews, and check the Crypto Fear & Greed Index.

Security Scan

The skill's declared purpose (watchlist, prices, alerts for crypto and stocks) matches the instructions and references; nothing obvious is requesting unrelated credentials or system access—but the package install/installation source is not specified and the skill's source is unknown, so exercise caution before installing or executing its CLI.

Purpose & Capability

Name and description match the instructions and reference docs: the SKILL.md documents a CLI-based watchlist that uses CoinPaprika / CoinCap / yfinance / Fear & Greed / Finnhub as described. Required capabilities (fetching prices, caching, alerts) are coherent with the declared purpose.

Instruction Scope

Runtime instructions are narrowly scoped to running the `clawwatch` CLI via the Bash tool, using `--json` for machine parsing, and optionally reading two cache files under ~/.clawwatch (latest.json, watchlist.json). Reading only those cache files is reasonable for the skill's purpose, but the agent will be executing shell commands and reading files in the user's home directory (under ~/.clawwatch) — confirm those files do not contain unrelated secrets before permitting access.

Install Mechanism

The skill is instruction-only (no install spec in registry), which is low static risk. However, SKILL.md suggests an installation step (`pip install clawwatch`) and references PyPI-like config flags; because the registry does not provide a vetted install spec or a known homepage/source, installing the package from an unverified source (PyPI or elsewhere) carries risk. The skill itself does not force installation, but if you allow the agent to run pip install, that action can fetch and execute arbitrary code.

Credentials

The skill declares no required environment variables or primary credential. Optional API keys (CoinCap, Finnhub) are mentioned only for higher rate limits / fallbacks and are proportional to the stated external services. No unrelated secrets or broad environment/config path access are requested.

Persistence & Privilege

always:false and no special privileges requested. The skill does not attempt to modify other skills or system-wide agent settings. Autonomous invocation is allowed by default (disable-model-invocation: false) which is normal and expected; this is not combined with other concerning privileges.

Assessment

This skill appears to be internally consistent with its stated purpose (watchlist, pricing, alerts). Before you install or let an agent run it: 1) Verify the `clawwatch` package source (PyPI project page or repository) — do not pip install from an unknown or untrusted source. 2) If you install, prefer a virtualenv/container and inspect the package code or its homepage. 3) Be aware the agent will execute the `clawwatch` CLI via Bash and may read ~/.clawwatch/*.json cache files — ensure those files don't contain private secrets or tokens. 4) Only provide optional CoinCap/Finnhub keys if you trust the package; treat those keys like any API secret. If you want higher assurance, ask the publisher for a repository link or a signed release before installing.

ClawWatch — Watchlist Skill

Quick Reference

User says...	You run...
"Füg Bitcoin zur Watchlist hinzu"	clawwatch add BTC
"Add NVIDIA and Tesla"	clawwatch add NVDA TSLA --tag portfolio
"Wie steht meine Watchlist?"	clawwatch check --json → parse & summarize
"Zeig mir nur die Kryptos"	clawwatch list --type crypto --json
"Alert wenn BTC über 100k geht"	clawwatch alert add BTC above 100000
"Alert if ETH drops 5% in a day"	clawwatch alert add ETH change 5
"Wie ist die Marktstimmung?"	clawwatch feargreed
"Entferne TSLA"	clawwatch remove TSLA
"Check my alerts"	clawwatch alert check --json
"Export als CSV"	clawwatch export --format csv

How to Use

1. Run commands via Bash tool: bash clawwatch <command>
2. Use --json flag to get machine-readable output you can parse
3. Summarize results in natural language for the user
4. For deep analysis, pass the JSON data to market-analyst agent

Important Rules

• Always use --json flag when you need to parse the output programmatically
• Don't run clawwatch check too frequently — respect API rate limits (max every 60 seconds)
• Auto-detection: Just pass symbols like BTC, ETH, NVDA, SAP.DE — the tool auto-detects crypto vs stock
• Alert exit codes: clawwatch alert check returns exit code 0 (no alerts) or 1 (triggered)

Combining with market-analyst

When the user asks for analysis (not just prices), chain:

1. clawwatch check --json → get current prices
2. Pass relevant data to market-analyst for interpretation
3. Deliver combined response

Reading Cached Data

Instead of running CLI commands, you can read cached data directly:

• ~/.clawwatch/latest.json — Last fetched prices
• ~/.clawwatch/watchlist.json — Full watchlist state

Installation

pip install clawwatch
# No API keys needed for crypto! Works out of the box.
# Optional: set CoinCap key for higher rate limits
clawwatch config --coincap-key YOUR_KEY  # optional