stock-analysis-aisa

Analyze stocks and cryptocurrencies with live AISA-backed scoring, signals, confidence, and risk flags. Use when: the user asks to analyze a ticker, compare...

Security Scan

The skill mostly matches its stated purpose, but it reads additional environment variables (including an overrideable base URL) that were not declared and relies on a remote model to 'fetch live data', which raises a proportionality and supply-chain concern.

Purpose & Capability

Name/description, required binary (python3), and required credential (AISA_API_KEY) align with a runtime that calls an external AIsa-style API to analyze tickers. The bundled script uses the OpenAI-style client to contact an AISA endpoint, which is consistent with the stated purpose.

Instruction Scope

SKILL.md instructs the agent to run scripts/analyze_stock.py. The Python script constructs prompts instructing the model to 'fetch live data' but does not itself call finance APIs (it relies on the AISA model/tooling to provide live prices, news, and metrics). The script does not read local files or unrelated system secrets. Relying on the remote model/tools for live-data collection is expected for this skill but expands the trust surface to the AISA endpoint and any tooling it invokes.

Install Mechanism

No install spec (instruction-only with a runnable script) — low install risk. The script lists a dependency on the openai Python package in comments but provides no automated install steps; users will need to install python dependencies manually.

Credentials

Declared requirement is only AISA_API_KEY, which is appropriate. However, the script reads additional env vars not declared in the SKILL.md: AISA_BASE_URL (defaults to https://api.aisa.one/v1) and AISA_MODEL. Allowing AISA_BASE_URL to be overridden means requests (and potentially sensitive data) could be directed to an arbitrary endpoint if that variable is set — this is an important un-declared capability and increases risk. AISA_API_KEY is a secret; ensure it is only given to a trusted provider.

Persistence & Privilege

always is false, the skill is user-invocable and does not request permanent presence or modify other skills or system-wide settings.

What to consider before installing

This skill appears to implement the advertised stock/crypto analysis and only needs an AISA API key and python. However: - The script allows overriding AISA_BASE_URL (default https://api.aisa.one/v1). If an administrator or environment sets AISA_BASE_URL to another host, the skill will send your queries (and the AISA_API_KEY) there — only set the base URL to a domain you trust. - The code relies on the remote AISA model/tooling to 'fetch live data' (it doesn’t call finance APIs itself). Using the skill sends tickers and prompts to the AISA endpoint, so only provide AISA_API_KEY for providers you trust with that data. - The SKILL.md does not declare AISA_BASE_URL or AISA_MODEL as env vars; that mismatch is a red flag — ask the author to document these env vars or remove the overrideable base URL. - Before installing: verify the AISA provider’s trustworthiness, consider creating a scoped API key with limited privileges if available, inspect and run the script in an isolated environment, and ensure python dependencies (openai) are installed from trusted sources.

Stock Analysis

When to Use

• Analyze stocks and cryptocurrencies with live AISA-backed scoring, signals, confidence, and risk flags. Use when: the user asks to analyze a ticker, compare investments, or review market positioning.

When NOT to Use

• Do not use this skill for browser-cookie extraction, passwords, Keychain access, or other local sensitive credential access.
• Prefer a different skill when the user request is outside this skill's domain.

Capabilities

• Score stocks and crypto assets with live data-backed analysis.
• Return BUY HOLD SELL style signals, confidence, and key risks.

Quick Start

export AISA_API_KEY="your-key"

Primary Runtime

Use the bundled Python client as the canonical ClawHub runtime path:

python3 scripts/analyze_stock.py

Example Queries

• Analyze AAPL versus MSFT and summarize the stronger setup.

Notes

• Informational only and not financial advice.