Infoway Financial API — Real-Time Quotes, Klines & Analysis
v0.1.2Real-time financial market data MCP server — stocks, crypto, forex quotes, klines, sector analysis and fundamentals
⭐ 0· 0·0 current·0 all-time
byInfoway API@infoway-api
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
The name, description, declared tools, and included Python package (pyproject, server code) all describe a financial-market MCP server and are consistent with each other. Minor inconsistency: registry metadata said 'instruction-only / no install spec', but the bundle includes package files and SKILL.md contains an install instruction (pip). This looks like a packaging/metadata mismatch rather than malicious behavior.
Instruction Scope
SKILL.md instructs only to install the package and provide INFOWAY_API_KEY; the server code reads only that environment variable and defines MCP tools. The instructions do not request reading unrelated system files, other env vars, or sending data to unexpected endpoints (network calls will go to the Infoway API via the infoway-sdk dependency, which is expected).
Install Mechanism
There is no high-risk custom installer: installation is via pip (package has pyproject.toml and console script). No downloads from untrusted URLs or archive extraction are present. Note: because the registry declared 'no install spec' but the package contains code and SKILL.md suggests pip, you should confirm the package's PyPI/GitHub sources before installing.
Credentials
Only one required secret (INFOWAY_API_KEY) is declared and used by the code. That is proportionate for a third‑party API client. No other credentials or config paths are requested.
Persistence & Privilege
The skill does not request always:true and does not modify other skills or system-wide settings. It runs as an MCP server and can be invoked by agents (disable-model-invocation is false, which is normal).
Assessment
This skill appears to do what it claims: an MCP server that queries Infoway's API and only needs an INFOWAY_API_KEY. Before installing, verify the package and its dependencies (infoway-sdk, mcp) on PyPI or the referenced GitHub repository to ensure the publisher is legitimate. Treat INFOWAY_API_KEY as a sensitive secret (don't paste it into public places). If you have concerns, run the package in an isolated environment (virtualenv or container) and inspect the infoway-sdk code (or the network calls it makes) to confirm endpoints and behavior.Like a lobster shell, security has layers — review code before you run it.
apivk9706ekrqw9vnvcktxqzy5q69h84bjxmcandlestickvk9706ekrqw9vnvcktxqzy5q69h84bjxmchina-stocksvk9706ekrqw9vnvcktxqzy5q69h84bjxmcryptovk9706ekrqw9vnvcktxqzy5q69h84bjxmdepthvk9706ekrqw9vnvcktxqzy5q69h84bjxmfinancevk9706ekrqw9vnvcktxqzy5q69h84bjxmforexvk9706ekrqw9vnvcktxqzy5q69h84bjxmfundamentalsvk9706ekrqw9vnvcktxqzy5q69h84bjxmheatmapvk9706ekrqw9vnvcktxqzy5q69h84bjxmhk-stocksvk9706ekrqw9vnvcktxqzy5q69h84bjxmklinevk9706ekrqw9vnvcktxqzy5q69h84bjxmlatestvk971brd5nqw5k3137hvpq5hasx84awg1market-datavk9706ekrqw9vnvcktxqzy5q69h84bjxmquotesvk9706ekrqw9vnvcktxqzy5q69h84bjxmreal-timevk9706ekrqw9vnvcktxqzy5q69h84bjxmsectorvk9706ekrqw9vnvcktxqzy5q69h84bjxmstockvk9706ekrqw9vnvcktxqzy5q69h84bjxmtradingvk9706ekrqw9vnvcktxqzy5q69h84bjxmus-stocksvk9706ekrqw9vnvcktxqzy5q69h84bjxmwebsocketvk9706ekrqw9vnvcktxqzy5q69h84bjxm
License
MIT-0
Free to use, modify, and redistribute. No attribution required.