Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

equity-research-analyst-skill

v1.0.0

Use when the user asks for institutional-style equity research on a public company, ETF, or TradingView-resolvable ticker, including initiation reports, earn...

0· 34·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for hypier/equity-research-analyst.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "equity-research-analyst-skill" (hypier/equity-research-analyst) from ClawHub.
Skill page: https://clawhub.ai/hypier/equity-research-analyst
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install equity-research-analyst

ClawHub CLI

Package manager switcher

npx clawhub@latest install equity-research-analyst
Security Scan
Capability signals
CryptoCan make purchasesRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill's name/description align with the included references and workflows (initiating coverage, earnings notes, valuation, etc.). However, the SKILL.md explicitly requires use of a RapidAPI-hosted TradingView proxy (RAPIDAPI_KEY) and external tooling (Python libraries, DOCX skill, Excel/XLS generation) that are not declared in the registry metadata (no required env vars, no required binaries, no primary credential). That mismatch is disproportionate: a research skill legitimately needs an API key and tooling, but those requirements should be declared.
Instruction Scope
SKILL.md is comprehensive and mostly scoped to research workflows and data sources (tradingviewapi for numeric data, web search for narrative). It directs creation of large deliverables (30+ page DOCX, 10k+ words, XLS model, 20–30+ PNG charts) and to produce clickable hyperlinks to external sources. The instructions do not ask the agent to read unrelated system files or harvest secrets, but they do assume access to external networks, the RapidAPI key, and local tooling to generate DOCX/XLS and images — all reasonable for the stated purpose but not declared in the packaging metadata, so the runtime behavior is under-specified.
!
Install Mechanism
There is no install spec (instruction-only), which lowers install-time risk. However, the skill expects use of Python (matplotlib/plotly), generation of many image files, and the DOCX/XLS skills or tooling to assemble deliverables. Because those runtime dependencies are not declared, an agent might attempt to install or execute tools not present on the host, or fail in unexpected ways. The absence of declared dependencies increases operational risk and obscures what will be required at runtime.
!
Credentials
SKILL.md explicitly says users must provide RAPIDAPI_KEY (RapidAPI) for TradingView data and references an x-rapidapi-host header and base URL, but the skill registry lists no required environment variables or primary credential. This is a direct inconsistency: the skill will function only if a secret API key is supplied, yet that key is not declared as required in the metadata. No other unrelated credentials are requested, but the missing RAPIDAPI_KEY declaration is material and increases the chance of misconfiguration or accidental key exposure.
Persistence & Privilege
The skill does not request elevated persistence (always: false) and does not claim to modify other skills or global agent settings. It requires creating output files (DOCX, XLS, PNG) as part of normal operation, which is reasonable for its purpose. No automatic autonomous invocation flagging is present beyond the platform default.
What to consider before installing
This skill appears to genuinely implement institutional equity‑research workflows, but there are important mismatches you should resolve before installing or enabling it. Key actions to take: 1) Ask the publisher to explicitly declare required credentials and runtime tools (RAPIDAPI_KEY, Python and which packages, and that the DOCX/XLS skills or toolchain are required). 2) Do not supply your RapidAPI key until you confirm where and how it will be stored/used; prefer per-agent scoped keys and least privilege. 3) Confirm the environment where the agent will run has the required tooling (Python, matplotlib/plotly, an Office-generation capability) or be prepared for failures. 4) If you cannot validate the publisher, run the skill in a sandboxed agent/container with no access to high-value credentials or internal network resources. 5) If you need assurance, request a minimal test mode: a run that performs only symbol-resolution and a read-only TradingView API call (no DOCX/XLS generation) so you can validate behavior and network endpoints. These steps will reduce the risk posed by the undeclared API key and missing dependency information.
!
references/tradingviewapi-docs/openapi.json:2916
Install source points to URL shortener or raw IP.
About static analysis
These patterns were detected by automated regex scanning. They may be normal for skills that integrate with external APIs. Check the VirusTotal and OpenClaw results above for context-aware analysis.

Like a lobster shell, security has layers — review code before you run it.

latestvk972p80fb4701bjjqeky1k2d1x85kf1y
34downloads
0stars
1versions
Updated 1d ago
v1.0.0
MIT-0

Equity Research Analyst

Produce institutional-grade equity research deliverables covering nine distinct workflows. Each workflow has its own dedicated reference file in references/workflows/; this SKILL.md is the dispatcher and the hub for cross-workflow conventions.

Loading Strategy

Keep context tight and load only the files needed for the active task.

  1. Match the request to exactly one workflow in references/workflows/.
  2. Read only that workflow file first.
  3. Open deep-dive references only when the active workflow points to them.
  4. Read references/tradingviewapi.md before opening anything in references/tradingviewapi-docs/.
  5. Treat references/tradingviewapi-docs/ as a lookup bundle: search by endpoint name or JSON field, then open the smallest relevant file instead of loading an entire large example file.

tradingviewapi lookup guide

  • Start with references/tradingviewapi.md for task-to-endpoint mapping.
  • Use references/tradingviewapi-docs/README.md for file selection inside the bundled API docs.
  • Use references/tradingviewapi-docs/openapi.json as the source of truth for exact parameters, defaults, and allowed enum values.
  • Use references/tradingviewapi-docs/examples/ mainly for concrete URL patterns and response shapes, not for deciding which asset-class parameter should be used.
  • If an example and the OpenAPI spec disagree, trust openapi.json for parameters and trust executed examples only for payload shape after the request has been validated against the spec.
  • Search patterns that usually find the right example quickly:
    • GET /api/market-data/{symbol}
    • GET /api/calendar/earnings
    • GET /api/search/market/{query}
    • earnings_release_next_date
    • analyst-recommendations

When to invoke which workflow

Match the user request to one of the nine workflows below and read the corresponding reference file from references/workflows/. If the request is ambiguous, ask the user to confirm before committing.

WorkflowTrigger phrasesReference
Initiating coverage"initiation report", "first-time coverage", "new coverage on X", "write a full report on X"references/workflows/initiating-coverage.md
Earnings analysis"earnings update", "Q1/Q2/Q3/Q4 results for X", "post-earnings report", "beat/miss analysis"references/workflows/earnings-analysis.md
Earnings preview"earnings preview", "what to watch in X's earnings", "pre-earnings note"references/workflows/earnings-preview.md
Catalyst calendar"catalyst calendar", "upcoming events", "earnings calendar", "event tracker"references/workflows/catalyst-calendar.md
Morning note"morning note", "daily brief", "pre-market note", "morning wrap"references/workflows/morning-note.md
Sector overview"sector report", "industry overview", "peer comp", "sector deep-dive"references/workflows/sector-overview.md
Thesis tracker"thesis tracker", "investment thesis review", "revisit thesis on X", "thesis check"references/workflows/thesis-tracker.md
Model update"update the model", "model maintenance", "refresh estimates", "re-forecast"references/workflows/model-update.md
Idea generation"screen for X", "find me stocks that", "idea generation", "investment ideas"references/workflows/idea-generation.md

Single-workflow discipline (especially for initiating-coverage)

The initiation-report workflow has five sequential tasks (Company Research → Financial Modeling → Valuation → Charts → Assembly). Execute one task per user request, verify prerequisites before the next task, and never auto-chain. Details in references/workflows/initiating-coverage.md.

Primary data source: tradingviewapi

Before Web Search, pull structured numeric data (financials, TTM ratios, analyst consensus, calendars, prices, technicals, news) from the bundled tradingviewapi (TradingView proxy). One call to /api/market-data/{symbol} covers ~70% of the numeric content of a typical research report.

  • Full endpoint map, curl examples, and JSON-path-to-report-field mapping: references/tradingviewapi.md
  • OpenAPI spec and example responses: references/tradingviewapi-docs/

Authentication: users must provide their own RAPIDAPI_KEY env var (RapidAPI hosted).

Use Web Search ONLY for narrative content: MD&A text, forward guidance wording, earnings call transcripts, segment breakdowns, risk factors, management bios, industry research, FDA/regulatory decisions. Pull raw SEC 10-K/10-Q only when direct quotation or audit is required.

Global conventions

Data freshness

  • Training data is outdated. Before writing, verify today's date and confirm that the latest fetched data is current (next earnings date, last reported quarter).
  • If data.current.fiscal_period_current is >90 days old, flag as "last reported" and Web Search for newer disclosures.
  • Treat data.current.fiscal_period_current as a structured provider label, not the final narrative quarter label. If company IR / SEC naming differs (for example provider 2025-Q4 vs company-reported Fiscal 2026 Q4), use the latest primary-source wording in the written report and cite that source explicitly.

Ticker resolution

  • Always use EXCHANGE:TICKER format (e.g., NASDAQ:AAPL, NYSE:JPM).
  • If the user supplies only a company name, resolve it via /api/search/market/{query}?filter=stock before proceeding.
  • Use the resolved symbol from /api/search/market/{query} as the canonical identifier for the workflow. Do not rely on data.company.ticker or data.company.exchange from /api/market-data/{symbol} as the canonical listing identifier, because those fields may be null or may reflect a quote venue rather than the primary exchange.

Citation standard

Every numeric fact in a deliverable must cite its source:

Source: Structured data via tradingviewapi (TradingView); fetched [YYYY-MM-DD]
        Endpoint: /api/market-data/NASDAQ:AAPL
        Fiscal period: 2026-Q1

SEC filings keep separate EDGAR hyperlinks. When consensus data comes from the API, cite the analyst-recommendations endpoint explicitly instead of a generic terminal label.

Output formatting

  • Default font for Word deliverables: Times New Roman.
  • Do not add emojis to research reports unless the user explicitly requests them.
  • Follow the page/structure templates in assets/initiating-coverage/report-template.md for initiation reports.
  • Use references/initiating-coverage/quality-checklist.md for final initiation-report QA.
  • Other workflows use the template embedded in their own reference file.

No shortcuts

  • Deliver exactly the outputs specified in each workflow reference. Do not create extra "completion summaries", "executive summaries", or "quick reference guides".
  • Do not fabricate data. Missing field → "N/A". Missing consensus → state "consensus not available".

Fallback strategy

  1. tradingviewapi unavailable → fall back to Web Search + SEC EDGAR per the workflow reference.
  2. Ticker unresolved → ask the user for EXCHANGE:TICKER.
  3. Ambiguous workflow → ask the user which deliverable they want.

Directory layout

equity-research-analyst/
├── SKILL.md                              # This file
├── references/
│   ├── tradingviewapi.md                   # Endpoint map + report-field mapping
│   ├── tradingviewapi-docs/                # Bundled API spec + examples (snapshot)
│   │   ├── README.md
│   │   ├── openapi.json
│   │   └── examples/ (12 .md files)
│   ├── workflows/                        # One dispatch target per workflow
│   │   ├── initiating-coverage.md
│   │   ├── earnings-analysis.md
│   │   ├── earnings-preview.md
│   │   ├── catalyst-calendar.md
│   │   ├── morning-note.md
│   │   ├── sector-overview.md
│   │   ├── thesis-tracker.md
│   │   ├── model-update.md
│   │   └── idea-generation.md
│   ├── earnings-analysis/                # Deep-dive references for earnings workflow
│   │   ├── workflow.md
│   │   ├── report-structure.md
│   │   └── best-practices.md
│   └── initiating-coverage/              # Deep-dive references for initiation tasks 1-5
│       ├── task1-company-research.md
│       ├── task2-financial-modeling.md
│       ├── task3-valuation.md
│       ├── task4-chart-generation.md
│       ├── task5-report-assembly.md
│       ├── quality-checklist.md
│       └── valuation-methodologies.md
├── assets/
│   └── initiating-coverage/              # Templates used in output
│       └── report-template.md

Comments

Loading comments...