Back to skill
Skillv1.0.0
ClawScan security
A Stocks Analysis · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 17, 2026, 6:01 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's declared purpose (read-only A-share/HK stock data lookup and analysis) aligns with its requirements and runtime instructions; it only asks for a single API key (TAX_API_KEY) and contains no installable code to inspect.
- Guidance
- This skill appears internally consistent and limited to read-only stock queries. Before installing, confirm the external service (https://tax.yyyou.top/) is trustworthy and matches your expectations. Do not paste your TAX_API_KEY into chat; configure it as a platform environment variable per the README. Because this is instruction-only (no code to audit), your platform enforces the actual network requests and environment exposure — verify the platform restricts which skills can access environment variables and that outgoing network egress is controlled. If you need stronger assurance, ask the publisher for an official API documentation or a known third-party host (e.g., GitHub/GitLab) and limit the API key's scope/permissions and lifetime (rotate/revoke if unused).
Review Dimensions
- Purpose & Capability
- okName/description, SKILL.md and README consistently describe a read-only stocks query/analyzer using /stocks/* routes and requiring TAX_API_KEY. The single required environment variable (TAX_API_KEY) is appropriate for calling an external stocks API.
- Instruction Scope
- okSKILL.md provides concrete routing, header, parameter, and output rules and explicitly bounds behavior (only call /stocks/*, do not handle /auth or /payment routes, do not request or echo the TAX_API_KEY). There are no instructions to read unrelated files, access other env vars, or exfiltrate data.
- Install Mechanism
- okThis is an instruction-only skill with no install spec or code files to execute; nothing is written to disk or downloaded during install.
- Credentials
- okOnly one credential (TAX_API_KEY) is required and is justified by the documented API auth scheme. No unrelated secrets or system config paths are requested.
- Persistence & Privilege
- okalways:false and normal autonomous invocation are used. The skill does not request elevated persistence or to modify other skills or system-wide settings.