Human Stock Helper

This skill is plausibly what it says (a trading helper), but there are several red flags you should address before installing or running it: - Hard-coded path: The code reads/writes memory files at /Users/maxhou/Desktop/openclawmax/memory. That is a developer-specific absolute path and could cause the skill to fail, overwrite, or attempt to read data in that location on your machine. Ask the author to make the storage directory configurable (or relative) and to not hard-code a home-folder path. - Metadata mismatch: SKILL.md recommends pip packages (akshare, yfinance, pandas, pandas-ta) but the registry metadata claims no install spec. The pip list in SKILL.md and the metadata are inconsistent (pandas appears in py_packages but not in the pip packages list). Installing packages will allow network access; review them and install in a virtualenv or sandbox. - Undeclared external calls: SKILL.md instructs use of 'mcporter call tavily.*' (an external service) and a backtest script path that is not included. The skill may send queries (which could include your holdings or trade notes) to Tavily or other external services. Confirm what data is sent and whether credentials are required and declared. - Missing/incorrect files: SKILL.md references scripts/backtest_strategy.py and some SKILL.md metadata differs from the included files. Confirm the repository includes all runtime scripts and that their behavior matches the documentation. - Run safely: If you want to try it, run inside an isolated environment (container or VM), and create a dedicated empty directory to map as the memory directory; inspect/modify the code to use a safe path before executing. Backup any important files first. - Ask the maintainer to: (1) remove hard-coded absolute paths or expose a configuration/env var for MEMORY_DIR, (2) declare install steps and required credentials clearly in registry metadata, (3) include or remove references to missing scripts/tools (backtest script, mcporter/Tavily), and (4) document what external endpoints will receive user data. If the author cannot justify these mismatches, treat the skill as unsafe to run with real account or sensitive data.