ClawHub

Stocks and Financial Data Pull

v4.1.8

56+ financial data tools via Yahoo Finance. Auto-routes stock prices, fundamentals, earnings, dividends, options, crypto, forex, commodities, news, and more.

⭐ 2· 1.7k·7 current·8 all-time
by@lkcair·duplicate of @lkcair/financial
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
ℹ
Purpose & Capability
Name/description (56+ Yahoo Finance tools) aligns with the provided code and SKILL.md. The included script imports yfinance, pandas, pydantic, and requests — all expected. Small inconsistency: registry metadata lists source/homepage as 'unknown'/'none' while the script header includes a repository URL and author info; this is explainable but worth verifying.
✓
Instruction Scope
SKILL.md instructions are narrowly scoped to creating a virtualenv, installing requirements, and running the library's async functions. It does not direct the agent to read unrelated system files, harvest credentials, or post data to unexpected endpoints. It does encourage adding invocation templates into the agent's TOOLS.md so the agent can call functions — that is expected for tool integration but gives the agent a persistent way to invoke the skill if the user chooses to add it.
ℹ
Install Mechanism
No platform install spec; installation is via a local virtualenv and pip install -r requirements.txt (PyPI packages). This is normal for a Python skill but carries the usual risks of pulling third-party packages from PyPI. No downloads from arbitrary URLs or archive extraction were specified.
✓
Credentials
The skill declares no required environment variables, no credentials, and no config paths. The libraries used operate without secrets for public market data, so the lack of requested secrets is appropriate.
ℹ
Persistence & Privilege
Skill flags are default (always: false, agent-invocable: true, model invocation allowed) which is normal. SKILL.md recommends injecting invocation patterns into the agent's TOOLS.md so the agent can call functions reliably — this is optional but would make the skill easy to invoke repeatedly. If you allow autonomous agent actions, consider whether you want that agent to call these methods without explicit confirmation.
Assessment
What to consider before installing: - Verify upstream: SKILL metadata omitted a homepage, but the script header references a GitHub repo; visit and inspect that repository to confirm provenance and check recent commits/issues. - Inspect the full scripts/yfinance_ai.py file yourself (or have a trusted reviewer do so) before running — the truncated preview looked consistent with yfinance usage but full inspection will reveal any unexpected network endpoints or data handling. - Install inside an isolated virtual environment (as the SKILL.md recommends) and do not run as root. - Be aware pip will pull packages from PyPI (yfinance, pandas, pydantic, requests); if you have policies about third-party packages, review those packages' reputations or pin versions. - Adding the invocation snippet to a global TOOLS.md (or otherwise giving the agent persistent access) makes the skill easier to use but also means the agent can call it more readily; only add if you trust the skill and the agent's permissions. - If you need higher assurance, run the skill in an isolated environment/network and use network monitoring the first time to confirm it only talks to expected endpoints (Yahoo Finance / yfinance-related endpoints).

Like a lobster shell, security has layers — review code before you run it.

latestvk973m91m44mjc4a9f5ggk6y1r981zd61

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments