Massive.com CLI

Bash CLI wrapper and OpenClaw skill for Massive's public REST API. Use when Codex or an OpenClaw agent needs to query Massive market-data endpoints from a sh...

Security Scan

The skill's purpose (a Bash wrapper for Massive's public API) is plausible, but the bundle and metadata contain inconsistencies (notably the core executable is missing from the distributed files and the registry metadata omits declared env inputs), and the documented support for exec-style secret refs increases the risk surface unless the runtime sandboxing is trusted.

Purpose & Capability

The name/description, SKILL.md, README, and references all describe a Bash CLI (scripts/massive) that resolves OpenClaw secret refs and talks to api.massive.com. However the published bundle in this registry snapshot does not include scripts/massive (the core executable), and the registry metadata at the top lists no required env vars while agents/openai.yaml and the documentation clearly expect MASSIVE_API_KEY_REF / MASSIVE_API_KEY / MASSIVE_BASE_URL. That mismatch suggests a packaging or metadata error and makes it unclear what will actually run if installed as-is.

Instruction Scope

SKILL.md and references restrict network access to the Massive API origin, require redaction, and instruct the agent to resolve secrets via OpenClaw SecretRefs. Those instructions stay within the stated purpose. One noteworthy scope detail: SecretRefs explicitly support an 'exec' source (execute a command and use stdout). That behavior is expected for OpenClaw-style secret resolution but it effectively permits the runtime to execute arbitrary commands when resolving a secret ref, so it increases the trust required of the runtime and any entity that can supply secret-ref payloads.

Install Mechanism

This is instruction-only (no install spec), which is low risk. There are no downloads or extract steps. However the repository bundle as published appears incomplete (scripts/massive is not present in the file manifest despite being required by SKILL.md and tests; BUNDLE_MANIFEST.md explicitly calls this out as a packaging error). That packaging inconsistency should be resolved before trusting the bundle.

Credentials

The environment/credential requirements documented (MASSIVE_API_KEY_REF preferred, MASSIVE_API_KEY fallback, and optional MASSIVE_BASE_URL) are appropriate for a CLI that authenticates to Massive. But the registry metadata at the top claiming 'Required env vars: none' contradicts agents/openai.yaml and the SKILL.md. Additionally, supporting 'exec' secret refs means a provided secret-ref JSON can cause the runtime to run arbitrary commands to fetch secrets — acceptable if the runtime enforces sandboxing, but disproportionate if secret refs can be supplied by untrusted parties or if the runtime has no strong isolation.

Persistence & Privilege

The skill does not request permanent presence (always:false) and does not modify other skills or global agent settings. allow_implicit_invocation is true in agent metadata, which is normal for skills and not a standalone concern here.

What to consider before installing

Do not install or enable this skill until the packaging and metadata inconsistencies are resolved. Specifically: (1) ask the publisher to include the scripts/massive executable in the published bundle and to re-run CI/tests so you can inspect the actual script content; (2) confirm the registry metadata lists the credential env vars (MASSIVE_API_KEY_REF / MASSIVE_API_KEY) so installers know what will be required; (3) review the scripts/massive source yourself for any unexpected network endpoints or shell execution; (4) if you will use secret refs that include 'exec', ensure your runtime enforces strict sandboxing and that only trusted principals can supply secret-ref JSON (because exec refs run arbitrary commands); and (5) verify the bundle signature or source repository before trusting it in automated agent workflows.

Massive CLI for OpenClaw

Use the bundled CLI before writing ad hoc curl commands. Keep requests deterministic, resolve credentials through OpenClaw-compatible secret references when available, and prefer narrow queries over broad scans.

Quick Start

• Read references/openclaw-secrets.md before configuring credentials.
• Read references/massive-api.md when choosing endpoints or query shapes.
• Read references/security.md before changing logging, auth, or error handling.
• Run scripts/massive health to validate local prerequisites and auth configuration.
• Run scripts/massive get /v3/reference/tickers/AAPL for a generic REST request.
• If you package or publish this skill, include every path listed in BUNDLE_MANIFEST.md.

Workflow

1. Resolve credentials through MASSIVE_API_KEY_REF when possible.
2. Fall back to MASSIVE_API_KEY only when a secret ref is not available.
3. Use a domain shortcut when it matches a documented Massive endpoint.
4. Use get for any other documented REST path.
5. Pipe JSON into downstream tools instead of enabling verbose logging.

Commands

• scripts/massive health
• scripts/massive get <path-or-next-url> [--query key=value ...]
• scripts/massive next to read next_url from stdin JSON and fetch the next page
• scripts/massive stocks ticker-details <ticker>
• scripts/massive stocks previous-close <ticker>
• scripts/massive options contract-details <options-ticker>
• scripts/massive forex currencies
• scripts/massive crypto currencies
• scripts/massive indices ticker-details <ticker>

Agent Rules

• Keep output in JSON unless a human-readable mode is explicitly needed.
• Send diagnostics to stderr; treat stdout as data.
• Never print resolved secrets, auth headers, or raw secret-ref payloads.
• Avoid --verbose in shared logs.
• Feed next_url back into get or next instead of reconstructing pagination manually.
• Treat non-api.massive.com absolute URLs as invalid unless MASSIVE_BASE_URL was explicitly changed to another HTTPS origin.

Resources

• scripts/massive: main Bash CLI
• BUNDLE_MANIFEST.md: required file list for packaged artifacts
• references/openclaw-secrets.md: credential and secret-ref contract used by this skill
• references/massive-api.md: endpoint selection and request patterns
• references/security.md: redaction and operational safety constraints