Access Finnhub API for real-time stock quotes, company news, market data, financial statements, and trading signals

• Verdict: Advisory
• Analyzed: Apr 30, 2026, 4:55 AM
• Findings: 0
• Version: 1.0.0
• Reason codes: None
• Engine: v2.4.5

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

NoteHigh Confidence

What this means

The agent may make Finnhub requests using your API key, which can reveal requested symbols/searches to Finnhub and may consume rate limits or paid-plan quota.

Why it was flagged

The skill needs a Finnhub credential and includes it in Finnhub API calls. This is purpose-aligned, but it gives the agent the ability to use that API key's quota and account entitlements.

Skill content

requires: { "env": ["FINNHUB_API_KEY"] } ... All requests require `?token=${FINNHUB_API_KEY}` parameter.

Recommendation

Use a Finnhub key with appropriate limits, monitor usage, and avoid sharing full request URLs or logs that contain the token.