Human Stock Helper

PassAudited by ClawScan on May 10, 2026.

Overview

This appears to be a purpose-aligned stock analysis and portfolio-record helper, but it stores trading records locally and references external market-data/search tooling that users should review.

Before installing, confirm the Python packages and Tavily/backtesting tools you want to use, review the hard-coded memory path, and treat the trading recommendations as advisory rather than automatic financial instructions.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI06: Memory and Context Poisoning

What this means

Your positions, cost basis, and trade history may remain on disk and may influence future analysis.

Why it was flagged

The skill persists portfolio and trade records to local JSON files under a hard-coded memory directory.

Skill content

MEMORY_DIR = Path("/Users/maxhou/Desktop/openclawmax/memory")
POSITIONS_FILE = MEMORY_DIR / "stock-positions.json"
TRADES_FILE = MEMORY_DIR / "stock-trades.json"

Recommendation

Use only if you are comfortable storing this financial information locally; keep the memory directory private and delete or relocate the files if needed.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing or invoking these tools may add dependencies or call services outside the included files.

Why it was flagged

The skill documents third-party packages and external/helper tools without version pins; these are aligned with market-data research but rely on external provenance.

Skill content

"packages": ["akshare", "yfinance", "pandas-ta"] ... `mcporter call tavily.tavily_search` ... `python scripts/backtest_strategy.py`

Recommendation

Verify the packages and any external Tavily/backtesting tooling before use, and prefer pinned, trusted dependency versions.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Stock tickers, questions, or portfolio details included in search prompts may be shared with the external search provider.

Why it was flagged

The documented workflow can send market research queries to an external Tavily tool/provider.

Skill content

| Tavily搜索 | `mcporter call tavily.tavily_search` | 市场消息、目标价 |

Recommendation

Avoid including brokerage credentials, account numbers, or unnecessary personal financial details in external search queries.