Claw Screener

PassAudited by ClawScan on May 1, 2026.

Overview

This stock-screening skill appears purpose-aligned, but users should notice that it runs local Bun scripts, contacts financial-data providers, and stores local cache/watchlist files.

This appears coherent for a stock screener. Before installing, be comfortable with running Bun scripts, installing the listed dependencies, making external financial-data requests, and keeping local watchlist/cache files on your machine.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill may add third-party packages to the local environment.

Why it was flagged

The skill requires installing package dependencies before running its local scripts. This is expected for a Bun/TypeScript stock screener, but users should recognize that dependency installation is part of use.

Skill content

## Installation

```bash
bun install
```

Recommendation

Install only from the expected source and review package changes if you are using it in a sensitive environment.

Note

ASI05: Unexpected Code Execution

What this means

Using the skill executes local code to fetch, process, and display stock-screening results.

Why it was flagged

The skill is used by running local Bun/TypeScript scripts. That execution is central to the stated stock-screening purpose and is documented rather than hidden.

Skill content

bun run src/screening.ts [options]

Recommendation

Run commands intentionally and prefer narrower options such as specific tickers or max ticker limits for quick checks.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Ticker symbols or market queries analyzed by the skill may be visible to external data providers.

Why it was flagged

The skill discloses that it contacts external financial-data providers. This is expected for stock analysis, but ticker queries and usage patterns may be sent to those services.

Skill content

Data Sources

- **US Stocks**: SEC EDGAR for fundamentals, Yahoo Finance for prices
- **Thai Stocks**: Yahoo Finance only

Recommendation

Avoid using sensitive personal notes or private strategy details as ticker inputs; treat provider calls as normal internet requests.

Note

ASI06: Memory and Context Poisoning

What this means

The skill may leave local files containing cached market data and user watchlist information.

Why it was flagged

The skill declares local persistent files for a watchlist and financial-data caches. This persistence is purpose-aligned, but watchlist entries and notes can reveal investment interests.

Skill content

files:
        - ~/.claw-screener-watchlist.json
        - sec_cache.db
        - price_cache.db

Recommendation

Review or delete the watchlist and cache files if you no longer want this information stored locally.