Yahoo Claw

This skill largely appears to do what it claims (use yahoo-finance2, optionally fallback to Alpha Vantage). Before installing: 1) Review SKILL.md and README for hidden control characters (the pre-scan flagged unicode-control-chars). 2) Confirm whether DATABASE_PATH/SQLite is actually required — the code shipped uses in-memory caching; if you don't want disk access, verify no SQLite or file-write code exists in the omitted files. 3) If you provide ALPHA_VANTAGE_API_KEY, store it securely (environment variable or secrets store); the key is optional and only used as a backup. 4) Run npm install and run the skill in a sandboxed environment first, monitor outbound domains (expected: Yahoo Finance endpoints and alphavantage.co), and inspect network traffic. 5) If you need higher assurance, ask the author or request a minimal reproducible build that shows whether any filesystem or external endpoints beyond finance APIs are contacted. If you are uncomfortable with the documentation inconsistencies or the unicode-control-chars finding, treat the package as untrusted until clarified.

These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.