Portfolio Optimizer

PassAudited by ClawScan on May 17, 2026.

Overview

This instruction-only skill is coherent with its stated virtual-trading purpose, but users should notice that it can place virtual buy/sell orders, fetch changing external analysis files, and maintain a persistent strategy state file.

Before installing, confirm that you want an agent that can place buy and sell orders in the virtual-trading MCP after an optimization request. If you prefer more control, instruct it to produce a proposed trade plan and wait for approval. Also verify the external news-analysis repository and periodically review the persistent strategy_state.md file.

Publisher note

MCPの価格情報とニュース分析を 組み合わせてポートフォリオを最適化し、割安資産の購入・割高資産の売却を実行する。 年率7%以上を目標とし、買い判断・売り判断・リバランス提案を行う。 ユーザーが「ポートフォリオを最適化して」「割安な資産を買って」「リバランスして」 「投資戦略を実行して」などと依頼したときにトリガーすること。

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may change holdings in the virtual-trading account when the user asks it to optimize or execute the strategy.

Why it was flagged

The skill explicitly directs the agent to place buy and sell orders through the virtual-trading MCP. This is central to the stated purpose and is disclosed, but it can still mutate the user's virtual portfolio.

Skill content
virtual-trading MCP の `sell_asset` および `buy_asset` で注文を執行する。
Recommendation

Use it only with the intended virtual-trading environment, and ask the agent to show proposed trades and wait for confirmation if you do not want automatic execution.

What this means

Future optimization decisions can change based on whatever content is currently in that external repository.

Why it was flagged

The workflow depends on fetching changing content from an external GitHub repository. This is purpose-aligned for obtaining news analysis, but the fetched content is not pinned to a specific commit.

Skill content
git pull あるいは `git clone git@github.com:kackyt/automatic-investment-strategy.git` を実行して最新のニュース分析を取得する
Recommendation

Verify that the repository is the intended source, consider pinning or reviewing updates, and avoid executing any fetched code unless separately reviewed.

What this means

A stale or edited strategy_state.md file could affect later virtual-trading decisions.

Why it was flagged

The skill reads and later overwrites a persistent strategy state file to keep decisions consistent across runs. This is disclosed, but persistent state can become stale or influence future agent behavior.

Skill content
`automatic-investment-strategy/analysis/strategy_state.md` ファイルを確認する(存在しなければ新規作成を想定)。
Recommendation

Periodically inspect or reset the strategy state file, and treat its contents as data for analysis rather than as authoritative instructions.

What this means

The clone step may require or use the user's existing GitHub SSH access to retrieve the repository.

Why it was flagged

Using the SSH GitHub URL may rely on the user's local GitHub SSH identity even though no credentials are declared in metadata. The artifact does not show credential collection or leakage.

Skill content
`git clone git@github.com:kackyt/automatic-investment-strategy.git`
Recommendation

Confirm the repository is trusted and that using your GitHub SSH identity is acceptable; use an HTTPS/public clone URL if you prefer not to use SSH credentials.