yahoo fetch data of stonks
PassAudited by ClawScan on May 1, 2026.
Overview
The skill coherently implements a simple Yahoo Finance quote lookup; the main things to notice are that it sends requested tickers to Yahoo and needs Node even though the registry requirements do not list it.
This appears safe for its stated purpose. Before installing, note that your ticker queries will be sent to Yahoo Finance and that the skill requires Node even though the registry requirements do not list it.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The stock symbols you query are sent to Yahoo Finance. The artifacts do not show credentials, files, or other local data being sent.
This shows the skill sends the requested stock symbols to a fixed Yahoo Finance API endpoint. That is purpose-aligned, but it is still an external API call users should be aware of.
const YAHOO_QUOTE_URL = "https://query1.finance.yahoo.com/v7/finance/quote"; ... url.searchParams.set("symbols", symbols.join(",")); ... await fetch(url.toString(),Use the skill only for ticker queries you are comfortable sending to Yahoo Finance, and confirm the endpoint and provider terms are acceptable for your use.
The skill may not run unless Node is available, despite the registry requirements not reflecting that dependency.
SKILL.md declares a Node runtime requirement, while the registry requirements supplied for review list no required binaries. This is an install/metadata clarity issue rather than evidence of hidden behavior.
requires:
bins: ["node"]Before installing, confirm Node is available and that the registry metadata is corrected to match the skill's declared runtime needs.