Skillv1.0.0

ClawScan security

A Stock Investment Analyst · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 8, 2026, 9:30 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: Instruction-only A‑share investment analysis skill whose requirements and instructions are consistent with its stated purpose and do not request extras like credentials or installs.
Guidance: This skill is internally coherent and low-risk as packaged (instruction-only, no installs, no secrets). Things to consider before installing/using: 1) The skill promises continuous monitoring (7x24) but provides no mechanism—you would need to integrate it with a real market-data feed or scheduling/orchestration to get that behavior. 2) No data sources or APIs are declared; outputs that include numerical market data will come from either user-supplied inputs or the model's internal knowledge and may be outdated or hallucinated—require the skill to cite verifiable sources and timestamps. 3) The author and homepage are unknown; if you need stronger provenance or regulatory compliance, prefer skills from known vendors or require explicit data-source configuration. 4) This is not investment advice—do not provide brokerage credentials or private account details to the skill. 5) If you plan to enable live monitoring or automated trades, set up explicit, minimal-permission integrations with reputable market-data and brokerage APIs and audit those connections separately.

Purpose & Capability: noteThe skill is an investment analysis assistant and all declared artifacts (SKILL.md, templates, methodology) align with that purpose. Note: it claims capabilities like "7x24小时持仓风险监控" but as an instruction-only skill it does not include any install, background process, or connectors to perform autonomous continuous monitoring—so that capability would require additional integration not provided here. Author/homepage are absent (source unknown), which reduces traceability.
Instruction Scope: noteRuntime instructions stay within analyst behavior (take user inputs, produce structured reports, cite sources). They do not instruct reading arbitrary files, accessing credentials, or calling external endpoints. Caveat: instructions expect data (financials, flows, Northbound/龙虎榜 info) but do not specify data sources or APIs; without a data feed the skill will rely on user-provided content or model knowledge and may hallucinate facts or timestamps.
Install Mechanism: okNo install spec and no code files — lowest-risk packaging. Nothing is downloaded or written to disk by the skill itself.
Credentials: okThe skill declares no required environment variables, credentials, or config paths. It does not request unrelated secrets or system access.
Persistence & Privilege: okalways is false and the skill does not request persistent or elevated privileges. It does not modify other skills or system settings.