yahoo fetch data of stonks
v1.0.2Fetch real-time stock quotes from Yahoo Finance.
⭐ 1· 4k·19 current·19 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill claims to fetch Yahoo Finance quotes and the included index.js does exactly that against https://query1.finance.yahoo.com/v7/finance/quote. Minor metadata inconsistency: SKILL.md declares a runtime dependency on 'node' (metadata.moltbot.requires.bins) and includes a homepage URL, but the registry metadata above lists no required binaries and no homepage. This is likely benign but worth noting.
Instruction Scope
SKILL.md instructions are narrowly scoped to accepting symbols and returning normalized quote JSON. They do not ask the agent to read arbitrary files, environment variables, or forward data to third-party endpoints beyond Yahoo Finance.
Install Mechanism
There is no install spec (instruction-only / bundled script), so nothing is downloaded or extracted at install time. The included index.js is small (~2.4 KB) and performs a single HTTPS request to Yahoo; no additional packages or external installers are pulled.
Credentials
The skill requires no environment variables, no credentials, and no config paths. That is proportionate to its purpose of fetching public market data.
Persistence & Privilege
The skill does not request always:true and does not modify other skills or system configs. It can be invoked autonomously by the agent (disable-model-invocation is false) which is the platform default and expected for this type of skill.
Assessment
This skill is small and does what it says: it issues an HTTPS GET to Yahoo Finance and returns normalized quote data. There are no requested secrets and no install-time downloads, so risk is low. Things to check before installing: ensure your environment has a compatible Node runtime (SKILL.md lists 'node' as required), confirm your organization's policy allows outbound requests to query1.finance.yahoo.com, and note the minor metadata mismatch (registry says no required binaries while SKILL.md requires node). If you require stricter controls, run the script in a sandboxed runtime or review/execute the index.js manually before enabling autonomous invocation.Like a lobster shell, security has layers — review code before you run it.
1.0vk978fnkcwz4w42ptyj584rf0d9804116latestvk9709d3rfxqc50kdnp6czkwnxd804qrg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.