CANSLIM-Top100-US

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing unpinned Python packages can pull newer or changed third-party code, though the packages are consistent with the stock-analysis purpose.

Why it was flagged

The dependency file lists packages without version pins or hashes; because SKILL.md instructs installing dependencies from this file if missing, the installed package versions may vary over time.

Skill content

yfinance
pandas
lxml
tqdm
requests

Recommendation

Install in a dedicated virtual environment and consider pinning reviewed dependency versions before use.

Note

ASI02: Tool Misuse and Exploitation

What this means

Running the skill will contact external data providers and create or overwrite the expected local results file.

Why it was flagged

The script uses external network calls for market data and writes a generated JSON results file; these operations are disclosed by the skill and fit the stock-screening function.

Skill content

response = requests.get(url, headers=headers) ... hist = stock.history(period="1y") ... json.dump(results_sorted, f, ensure_ascii=False, indent=4)

Recommendation

Run it only when network access to public market-data sources is acceptable, and check the generated results file before relying on the output.