v1.3.0

investoday-stock-financial-analysis

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 8:17 AM.

Analysis

This instruction-only finance skill appears purpose-aligned and limited to reading public stock data through a declared finance-data dependency.

GuidanceThis skill looks safe for its stated purpose of generating financial-analysis reports from public stock data. Review the separate investoday-finance-data dependency, and avoid entering private personal or confidential information because stock identifiers may be sent to the financial data API.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

SKILL.md

requires:\n      skills: ["investoday-finance-data"]

The skill depends on a separate finance-data skill that is not included in the provided artifact set; this is disclosed and purpose-aligned, but users should review the dependency because it controls the underlying data access.

User impactThe main behavior of fetching financial data depends on another skill, so the safety and privacy properties also depend on that separate component.

RecommendationBefore installing, review the investoday-finance-data skill and confirm its data sources, permissions, credential handling, and API behavior are acceptable.

Tool Misuse and Exploitation

SeverityInfoConfidenceHighStatusNote

SKILL.md

Step 1-7 可并行调用；分析时以最新一期财报为主，并用最近 2-4 期数据辅助判断趋势。

The skill instructs the agent to call multiple read-only financial data tools, potentially in parallel. This is expected for the stated financial analysis purpose and is limited to GET-style market-data retrieval.

User impactUsing the skill may send the requested stock name or code to the declared financial data provider to retrieve public market data.

RecommendationUse it for public stock-analysis questions, and avoid including unnecessary personal or confidential information in the stock query.