Avanza Investment Tracker
v1.0.1Process Avanza CSV exports, calculate TWRR/Modified Dietz returns, and track portfolio performance. Use when importing stock transactions, calculating invest...
⭐ 0· 113·0 current·0 all-time
byPatrik Ekenberg@patello
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (process Avanza CSVs, calculate TWRR/Modified Dietz, track performance) matches the included code and CLI. Required libraries (requests, sqlite3, csv, json) are what you'd expect for parsing CSVs, storing data in SQLite, and fetching prices. No unrelated binaries or credentials are requested.
Instruction Scope
SKILL.md instructs running local Python scripts against user data stored outside the skill directory; commands reference only the declared files and local database. The CLI exposes destructive operations (reset --confirm) which is expected for a DB-backed tool and is clearly documented. No instructions ask the agent to read unrelated system files or exfiltrate data.
Install Mechanism
No install spec is provided (instruction-only), which minimizes write-to-disk risk. There is a small requirements.txt listing only 'requests' — typical and low-risk. Nothing is downloaded from arbitrary URLs or executed from unknown remote archives.
Credentials
The skill requires no environment variables, no credentials, and no config paths. Network access via the requests library is used only to fetch prices (expected); no secret-scoped env vars are requested or used in the visible code.
Persistence & Privilege
The skill is not forced-always and uses normal CLI invocation. It stores and manipulates data in a user-specified SQLite DB located outside the skill directory. It does include destructive DB reset operations, but those are expected and opt-in.
Assessment
This appears to be a coherent local portfolio tracker. Before installing: (1) Review where update_prices() fetches live prices (the code imports requests) if you want to confirm which third‑party endpoints are queried; (2) keep your data files (transactions.csv, asset_data.db, special_cases.json) outside the skill directory as recommended and back up your DB before running reset or import; (3) run pip install -r requirements.txt in a virtual environment; (4) if you have privacy concerns, run the tool offline (without --update-prices) or inspect network calls with a proxy. The code contains no requests for credentials or unusual system access.Like a lobster shell, security has layers — review code before you run it.
latestvk97amcq8mn2v6hzj8sxy1m9k5d84bsza
License
MIT-0
Free to use, modify, and redistribute. No attribution required.