Security checks across malware telemetry and agentic risk
The skill is a coherent finance briefing tool, but its automated cron scripts can send portfolio and alert information to a hard-coded WhatsApp recipient if installed or run unchanged.
Review and edit the cron scripts before installing or scheduling this skill. Remove the hard-coded FINANCE_NEWS_TARGET value, set your own delivery target explicitly, and avoid enabling no-approval cron workflows until you are comfortable sending portfolio, alert, and earnings content to the configured channel. Treat debug/raw JSON outputs, portfolio files, and API keys as sensitive financial data.
results = []
for symbol in symbols[:10]: # Limit to 10 symbols
try:
result = subprocess.run(
[OPENBB_BINARY, symbol, '--earnings'],
capture_output=True,
text=True,results = []
for symbol in symbols[:10]: # Limit to 10 symbols
try:
result = subprocess.run(
[OPENBB_BINARY, symbol, '--rating'],
capture_output=True,
text=True,try:
req = urllib.request.Request(url, headers={'User-Agent': 'OpenClaw/1.0'})
with urllib.request.urlopen(req, timeout=timeout, context=SSL_CONTEXT) as response:
return response.read()
except urllib.error.URLError as e:
last_error = eVirusTotal findings are pending for this skill version.