Back to skill
Skillv1.0.0
ClawScan security
yahoo-finance-bist · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
ReviewMar 1, 2026, 8:06 PM
- Verdict
- Review
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's code matches its Yahoo Finance analysis purpose, but the runtime instructions force the agent to always execute local scripts and to suppress any model reasoning/output — an unusual, high-risk behavior that warrants caution.
- Guidance
- What to consider before installing: - The code provided implements the advertised Yahoo Finance features and does not request credentials, but SKILL.md forces the agent to run local scripts and only return their output (no model reasoning shown). That pattern is unusual because it makes the agent a blind conduit for script outputs — verify you trust the included scripts. - Review the included Python files yourself (they are bundled) and confirm they do only what you expect: fetch Yahoo endpoints, compute indicators, and write CSV/HTML in the skill folder. They do not contact other external domains or read arbitrary system files. - Confirm the exec paths in SKILL.md (/home/node/.openclaw/skills/yahoo_portfoy_analiz/...) match where the skill will be installed. If not, the agent may fail to run or attempt to execute different code. - Because scripts write files and can create many CSVs, run the skill in a sandboxed environment or with limited filesystem/network permissions if possible. - If you plan to allow autonomous agents to use this skill, consider disabling autonomous invocation or requiring explicit user confirmation before running any scripts, so the agent cannot silently execute code on keyword matches. - If you need higher assurance, ask the publisher for a signed release or run the scripts manually in a controlled environment to validate outputs before allowing automatic execution.
Review Dimensions
- Purpose & Capability
- okName/description, the four Python scripts, and included data files all implement Yahoo Finance historical data fetch, indicator calculation (RSI, MACD, Stoch, SMA), CSV/Excel export, portfolio alerts and trade logging — consistent with the stated purpose.
- Instruction Scope
- concernSKILL.md mandates the agent must run specific exec commands (absolute paths) for user queries, announce 'script is running', then read and relay ONLY the script output and must not use any internal knowledge. This enforces blind execution of local code and suppresses model reasoning/transparency. Although the included scripts appear to access only Yahoo Finance and local files, the enforced output-only workflow increases risk (it can hide what the agent did) and is unusual. The SKILL.md also uses absolute paths (/home/node/.openclaw/skills/...), which may not match the deployment location of the provided files — an operational inconsistency.
- Install Mechanism
- okNo install spec / no external downloads. All source files are included in the skill bundle (no network install step), so there's no remote installer or archive to fetch.
- Credentials
- okThe skill requires no environment variables or credentials; scripts call only Yahoo Finance public endpoints and read/write files under the skill directory. The requested access (network to Yahoo, local file read/write) is proportionate to the described features.
- Persistence & Privilege
- notealways:false and user-invocable:true. The scripts create and manage local files (trade_history.json, portfolio_alerts.json, CSVs under symbol_data/) and will remove old CSVs if many accumulate. The skill does not request system-wide config or other skills' credentials. Be aware the platform default allows autonomous invocation (disable-model-invocation:false); combined with the SKILL.md requirement to auto-exec scripts on matching keywords, this increases blast radius if the agent is permitted to act autonomously.