Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Rally
v3.0.1Research, score, and plan long-only portfolio allocations and trades for public markets with risk constraints and explainable decisions.
⭐ 0· 41·0 current·0 all-time
byIndigo Karasu@indigokarasu
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name, description, commands, and declared filesystem read/write paths all match a portfolio research/plan workflow. Optional QUIVERQUANT_API_KEY (for congressional trades) is appropriate for the described congressional_flow feature. No unrelated credentials or binaries are requested.
Instruction Scope
SKILL.md limits actions to portfolio ingestion, universe screening, signal computation, plan generation, journaling, and local JSONL persistence in ~/openclaw/data/ocas-rally and journals. It also documents cron registration (daily jobs) and a self-update command that pulls from GitHub — these are consistent with the operating model but are side-effectful (network and system-scheduling access) and worth reviewing.
Install Mechanism
There is no formal install spec in the registry (instruction-only), though the SKILL.md/frontmatter suggests installing from a GitHub URL. Instruction-only reduces upfront install risk, but the self-update mechanism (rally.update) implies future code pulled from GitHub may be executed or used by the skill; verify the upstream repo before enabling auto-updates.
Credentials
The only declared optional credential is QUIVERQUANT_API_KEY for an optional congressional-flow signal. No broad or unrelated environment variables or secrets are requested. Filesystem access is scoped to the skill's own data and journal directories under the user's home, which is proportionate for persistent portfolio state.
Persistence & Privilege
always:false and execution is disabled by default; however, the skill expects to create local data files and register cron jobs (daily reporting and self-update). Combined with the self-update capability, this gives the skill ongoing presence and the ability to fetch code — acceptable for this use case but warrants manual review and conservative defaults (keep execution disabled, require explicit deployment approvals).
Assessment
This skill looks coherent for portfolio research and constrained allocation planning, but take these precautions before installing or enabling: 1) Inspect the GitHub repository referenced by the skill (https://github.com/indigokarasu/rally) so you know exactly what the self-update will fetch. 2) Keep config.execution.enabled = false until you review broker integrations and confirm any broker credentials are only provided to explicit, audited integration steps. 3) If you do not want automated runs or auto-updates, disable cron registration / rally.update or run them manually. 4) Only provide QUIVERQUANT_API_KEY if you want the congressional_flow signal; it is optional. 5) Verify that writing to ~/openclaw/data/ocas-rally/ and ~/openclaw/journals/ocas-rally/ matches your storage/permission policies and back up any sensitive files. If you want higher assurance, ask the publisher for a signed release tarball or review the repo history and install steps before enabling self-update or scheduling.Like a lobster shell, security has layers — review code before you run it.
latestvk972d0r6vkndpszwssctj7bmwh83rv4g
License
MIT-0
Free to use, modify, and redistribute. No attribution required.