Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Global Stock Analysis

Workflow-based stock and market analysis using marketdata-cli. Guides you through stock lookups, fundamental analysis, technical analysis, macro overviews, s...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 28 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The SKILL.md describes workflows using marketdata-cli and an AlphaVantage API key, which matches the declared purpose (market/stock analysis). However the registry metadata claims no required env vars/binaries while the SKILL.md explicitly requires ALPHAVANTAGE_API_KEY and marketdata-cli — an inconsistency. Also there is no homepage or source URL to vet the owner or package.
Instruction Scope
The instructions are limited to installing/using marketdata-cli and supplying an AlphaVantage API key, with example commands for quotes, fundamentals, technicals, macro, forex/crypto. They do not instruct reading unrelated files, accessing other credentials, or exfiltrating data.
Install Mechanism
This is an instruction-only skill (no install spec). It tells users to 'pip install marketdata-cli' (or use uv/uvx). Installing a third-party PyPI package is normal for this tool but carries the usual risk that the package may run arbitrary code on install — the skill itself doesn't bundle code, so the main risk is the external package.
Credentials
Requesting an ALPHAVANTAGE_API_KEY is proportionate to the stated function. The problem is the registry metadata did not declare any required env vars or a primary credential even though the SKILL.md requires the API key — this metadata omission reduces transparency and prevents automated gating of credentials.
Persistence & Privilege
The skill does not request persistent/always-on privileges and contains no install-time behavior that would modify other skills or system-wide settings. Autonomous invocation is allowed by default but not combined with other alarming flags.
What to consider before installing
This skill appears to be what it says (terminal workflows that call marketdata-cli) but the package/source aren't provided in the registry metadata and the SKILL.md expects you to install a third‑party PyPI package and set an ALPHAVANTAGE_API_KEY. Before installing or running commands: 1) Verify the marketdata-cli package on PyPI/GitHub (check repository, maintainer, recent activity, and code) and confirm the package name matches the SKILL.md; 2) Prefer installing into a disposable virtualenv or container to limit install-time risks; 3) Do not store your API key in world-readable files — prefer passing it per-command or using a secure secret store; 4) Review the marketdata-cli source for suspicious network endpoints or telemetry; 5) Because the skill registry omitted required metadata (no homepage, no declared env var), treat it as unvetted — if you cannot verify the upstream project, avoid installing.

Like a lobster shell, security has layers — review code before you run it.

Current versionv0.0.1
Download zip
latestvk9794cg3eh1d5adv0tzgbgzmah831w2v

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Global Stock Analysis

Use these workflows to research stocks, evaluate companies, read technical signals, and monitor macro conditions — all from the terminal.

Setup

  1. Install: pip install marketdata-cli or uv tool install marketdata-cli --force or run directly with uvx marketdata-cli
  2. Set API key (one of):
    • export ALPHAVANTAGE_API_KEY=your_key
    • Add ALPHAVANTAGE_API_KEY=your_key to a .env file
    • Pass -k your_key on each command

Get a free key at https://www.alphavantage.co/support/#api-key

Workflows

1. Quick Stock Lookup

Get a snapshot of where a stock is right now — price, recent history, and news.

marketdata-cli global_quote AAPL
marketdata-cli time_series_daily AAPL
marketdata-cli news_sentiment --tickers AAPL
# Optional: intraday detail
marketdata-cli time_series_intraday AAPL --interval 5min

2. Fundamental Analysis

Evaluate a company's financial health: overview, financials, earnings, dividends, and insider activity. See fundamentals.md for the full step-by-step guide.

3. Technical Analysis

Assess trend, momentum, volatility, and volume signals. See technicals.md for the full step-by-step guide.

4. Macro & Market Overview

Check economic conditions, commodities, market movers, and upcoming events. See macro.md for the full step-by-step guide.

5. Sector / Multi-Stock Comparison

Compare fundamentals or technicals across multiple tickers by running the same commands for each symbol:

marketdata-cli company_overview AAPL
marketdata-cli company_overview MSFT
marketdata-cli company_overview GOOGL

See comparison.md for more examples.

6. Forex & Crypto

Exchange rates and price history for currencies and cryptocurrencies. See forex-crypto.md for the full step-by-step guide.

Quick Reference

Run marketdata-cli --help for the full list of 100+ commands, or marketdata-cli <command> --help for any specific command.

FlagDescription
-k, --api-keyAPI key (overrides env var)
-v, --verboseEnable verbose logging
-h, --helpShow help for any command
  • Most stock commands accept a positional SYMBOL argument (e.g., marketdata-cli global_quote AAPL)
  • Forex commands use --from_symbol / --to_symbol or --from_currency / --to_currency
  • Technical indicators default to daily interval if not specified

Files

6 total
Select a file
Select a file to preview.

Comments

Loading comments…