Financial Event Historical Impact Analyzer

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Your market-data API tokens may be used to make requests and may consume provider quota or reveal usage to those services.

Why it was flagged

The skill uses provider API credentials for Tushare and optionally FRED, which is expected for financial data retrieval but gives the skill access to those provider accounts or quotas.

Skill content
"requiredEnvVars": ["TUSHARE_TOKEN"], "optionalEnvVars": ["FRED_API_KEY"], "primaryCredential": "TUSHARE_TOKEN"
Recommendation

Use dedicated, least-privilege API keys where possible and confirm the environment variables are only set for services you intend to use.

What this means

Running an analysis will contact external services and create local report/data/chart files.

Why it was flagged

The skill explicitly performs network calls to external market-data providers and writes output files; these capabilities are central to its stated purpose.

Skill content
"networkAccess": true, "externalServices": ["Yahoo Finance", "Tushare API", "FRED API"], "outputsFiles": true, "writesFiles": true
Recommendation

Run it only for intended analyses, be aware of API quotas, and review the generated output directory.

What this means

Installing dependencies adds third-party code to the local Python environment.

Why it was flagged

The skill documents user-directed installation of third-party Python packages; this is normal for a data-analysis skill but depends on external package provenance.

Skill content
pip install yfinance pandas numpy matplotlib tushare
Recommendation

Install packages from trusted indexes, consider using a virtual environment, and pin versions if reproducibility is important.

What this means

Analysis outputs and possibly user-specific event descriptions may remain on disk after the run.

Why it was flagged

The workflow stores generated data, charts, and reports in a persistent workspace memory path.

Skill content
OUTPUT_DIR="$HOME/.openclaw/workspace/memory/reports/brent_crude_20260328_increase"
Recommendation

Review or delete old report folders if you do not want generated analysis artifacts retained.