Portfolio Tracker

Automatically tracks and analyzes Vish's stock and crypto portfolio using live Yahoo Finance data, providing updates, performance summaries, and rebalancing...

Security Scan

The skill's functionality matches a portfolio tracker, but its runtime instructions ask the agent to attach an existing Chrome profile for browser automation (access that can expose unrelated browser data) without declaring that access — this mismatch and the handling of sensitive holdings warrants caution.

Purpose & Capability

Name and instructions align with a portfolio tracking use-case: reading a local holdings file, scraping Yahoo Finance for quotes, computing values, and writing an analysis file. The included python script simply parses the holdings file and prints samples, which is consistent with the stated purpose. However, the SKILL.md explicitly instructs attaching a Chrome profile (profile=open-claw-chrome) for browser automation; that capability is plausible for scraping but is not reflected in declared requirements (no config paths or permissions).

Instruction Scope

Instructions tell the agent to read references/portfolio-holdings.md and to attach a Chrome extension/profile and snapshot Yahoo Finance pages to extract prices. Reading the holdings file and scraping Yahoo Finance is in-scope, but 'attach Chrome extension (profile=open-claw-chrome)' implies access to an existing browser profile (cookies, other tabs, stored auth) which is broader than the skill's stated data needs. The instructions do not direct data to external endpoints beyond Yahoo Finance, and the skill does not instruct exfiltration, but the implicit request to access a browser profile is a significant scope expansion that isn't documented as a required config path or permission.

Install Mechanism

There is no install spec; the skill is instruction-only plus a small helper script. Nothing is written to disk by an installer and no external code downloads are requested, which is low risk from an install mechanism perspective.

Credentials

The skill declares no required environment variables or config paths, yet runtime instructions expect access to a specific Chrome profile name. That is an access mismatch: attaching an existing browser profile can expose broad sensitive data (cookies, sessions, other sites) but there is no explicit declaration or justification in the manifest. The holdings file is local and expected to be read, which is proportionate to the purpose, but it contains sensitive financial information and the skill will read and process it.

Persistence & Privilege

The skill is not marked always:true, is user-invocable, and does not request persistent/system-wide modifications in the manifest. There is no evidence it modifies other skills or global configuration.

What to consider before installing

This skill appears to do what it says (read a local holdings file, scrape Yahoo Finance, update a portfolio file), but exercise caution before installing/using it: - The SKILL.md asks the agent to 'attach' an existing Chrome profile (profile=open-claw-chrome). That can give the automation access to cookies, logged-in sessions, and other browser data unrelated to portfolio tracking. Confirm what 'attach' means in your environment and whether you are comfortable granting that access. - The holdings file contains real financial and crypto positions. Only run this skill if you trust the skill owner and the runtime environment; consider using a sanitized/test holdings file first. - The included Python script is small and appears harmless (it just reads and parses the local holdings file). Still review any code before use and run in a sandbox if possible. - If you need to mitigate risk: create a dedicated browser profile with no saved logins and only the minimal extension/context required; or modify the workflow to use an ephemeral browser context instead of attaching an existing profile. If the author documents why a profile must be attached (and declares the config path or permission), or if the skill is updated to launch a fresh browser context instead of attaching an existing profile, my concern would be reduced.

Quick Start

Run portfolio update or ask "update my portfolio" to fetch live prices via browser and generate analysis.

Workflow

1. Read holdings from references/portfolio-holdings.md
2. Browser automation: Attach Chrome extension (profile=open-claw-chrome) to Yahoo Finance
3. Fetch prices: Snapshot ticker pages or portfolio view
4. Update portfolio-tracker.md with new values/performance
5. Generate analysis: Winners/losers, total value, suggestions

Update Portfolio

1. browser action=tabs profile=open-claw-chrome (attach Yahoo Finance tab)
2. For each ticker in holdings:
   - browser navigate https://finance.yahoo.com/quote/[TICKER]
   - browser snapshot refs=aria (extract price, change, %change)
3. Parse snapshots, calculate values (shares * price)
4. edit portfolio-tracker.md with new table
5. Add analysis section (winners/losers, market summary)

Crypto: Use https://finance.yahoo.com/quote/BTC-USD etc.

Analysis Patterns

• Winners/Losers: Top 5 +5% / -5%
• Concentration Risk: Flag if any position >15% total
• Market Context: S&P500/Nasdaq from ^GSPC/^IXIC snapshots
• Suggestions: Beaten-down positions (< -5% today)

Structuring This Skill

[TODO: Choose the structure that best fits this skill's purpose. Common patterns:

1. Workflow-Based (best for sequential processes)

• Works well when there are clear step-by-step procedures
• Example: DOCX skill with "Workflow Decision Tree" -> "Reading" -> "Creating" -> "Editing"
• Structure: ## Overview -> ## Workflow Decision Tree -> ## Step 1 -> ## Step 2...

2. Task-Based (best for tool collections)

• Works well when the skill offers different operations/capabilities
• Example: PDF skill with "Quick Start" -> "Merge PDFs" -> "Split PDFs" -> "Extract Text"
• Structure: ## Overview -> ## Quick Start -> ## Task Category 1 -> ## Task Category 2...

3. Reference/Guidelines (best for standards or specifications)

• Works well for brand guidelines, coding standards, or requirements
• Example: Brand styling with "Brand Guidelines" -> "Colors" -> "Typography" -> "Features"
• Structure: ## Overview -> ## Guidelines -> ## Specifications -> ## Usage...

4. Capabilities-Based (best for integrated systems)

• Works well when the skill provides multiple interrelated features
• Example: Product Management with "Core Capabilities" -> numbered capability list
• Structure: ## Overview -> ## Core Capabilities -> ### 1. Feature -> ### 2. Feature...

Patterns can be mixed and matched as needed. Most skills combine patterns (e.g., start with task-based, add workflow for complex operations).

Delete this entire "Structuring This Skill" section when done - it's just guidance.]

[TODO: Replace with the first main section based on chosen structure]

[TODO: Add content here. See examples in existing skills:

• Code samples for technical skills
• Decision trees for complex workflows
• Concrete examples with realistic user requests
• References to scripts/templates/references as needed]

Resources

references/portfolio-holdings.md

Vish's exact holdings (shares/amounts). Update manually when buying/selling.

scripts/update-portfolio.py

Parses holdings, processes browser data (future: full automation).