Skills of ETF data released by ft.tech.
PassAudited by ClawScan on May 1, 2026.
Overview
This appears to be a straightforward ETF market-data skill that runs included Python scripts to query market.ft.tech and can optionally save PCF XML files, with no credential use or hidden persistence evident.
This skill looks safe for ETF market-data lookup. Before installing, note that it runs bundled Python scripts, contacts market.ft.tech, and may save PCF XML files when requested; avoid using output filenames that overwrite existing files.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Installing the skill lets the agent run the included Python code when answering ETF data questions.
The skill is implemented by executing local Python handler scripts. This is disclosed and purpose-aligned, and the dispatcher allowlists subskills found under the package rather than accepting arbitrary paths.
result = subprocess.run([sys.executable, handler] + sys.argv[2:], cwd=SKILL_ROOT)
Only install if you are comfortable with this included Python code being run for ETF data queries; keep the package contents intact and avoid adding untrusted handler files.
ETF symbols, dates, filters, or PCF filenames are sent to market.ft.tech, and a PCF download can create or overwrite a local file if an output path is provided.
The PCF download handler retrieves data from the disclosed external market-data domain and can write the downloaded XML to a user-supplied output path. The code constrains output paths under the working directory, but the behavior is still worth noticing.
BASE_URL = "https://market.ft.tech" ... with urllib.request.urlopen(req) as resp: data = resp.read() ... with open(out_path, "wb") as f: f.write(data)
Use the skill for requested ETF data only, and choose safe PCF output filenames that will not overwrite existing skill or project files.