Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

super-stock-analysis

v1.0.0

Analyze stocks and cryptocurrencies using Yahoo Finance data. Supports portfolio management, watchlists with alerts, dividend analysis, 8-dimension stock sco...

0· 72·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for subaru0573/super-stock-analysis.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "super-stock-analysis" (subaru0573/super-stock-analysis) from ClawHub.
Skill page: https://clawhub.ai/subaru0573/super-stock-analysis
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: uv
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install super-stock-analysis

ClawHub CLI

Package manager switcher

npx clawhub@latest install super-stock-analysis
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (market analysis, portfolio, alerts, trend scanning) align with the included Python scripts and documented commands. The declared runtime binary 'uv' is consistent with the provided 'uv run ...' examples. Minor inconsistencies: some examples call 'python3' directly while others use 'uv', and README/storage paths differ (README: ~/.marketpulse vs code default: ~/.clawdbot), which is sloppy but explainable.
!
Instruction Scope
SKILL.md and README instruct running local scripts that fetch data from Yahoo Finance, CoinGecko, SEC, Google News, and social media—expected for this product. However README includes step-by-step guidance to extract Twitter/X cookies from browser DevTools and store AUTH_TOKEN/CT0 in a .env file, which is a sensitive, manual cookie-extraction flow that encourages copying session cookies (high-risk). The README also tells users to install an npm bird CLI and to run cron jobs; those dependencies and credentials are not declared in the skill metadata. The presence of scripts that perform filesystem writes (portfolio/watchlist storage) and a batch_refactor script that auto-modifies repository files increases risk if users or agents run them unvetted.
Install Mechanism
The only install step is a Homebrew formula 'uv' which matches the runtime commands. Brew installs are lower risk than arbitrary downloads, but 'uv' as a formula is uncommon—verify the formula identity/source before installing. No remote archive downloads or extract operations are present in the manifest.
!
Credentials
Metadata declares no required env vars, yet README and some features require optional credentials (Twitter/X cookies: AUTH_TOKEN, CT0) and suggest installing bird CLI. These sensitive cookie values are not declared in requires.env or primaryEnv. The code uses an env var MARKETPULSE_DATA_DIR to change storage location (defaults to ~/.clawdbot), while README documents ~/.marketpulse/data — inconsistent. Asking users to paste browser cookies into .env is disproportionate to the stated purpose and raises credential-exfiltration risk if followed without caution.
Persistence & Privilege
The skill does not request always:true and does not require system-wide configuration modifications in the manifest. It stores user data locally (portfolios/watchlist) under a user home path and includes an auto-refactor script that would modify files if run; that script modifies repository files but is not automatically invoked by the skill metadata. No evidence the skill modifies other skills or system-wide agent settings.
What to consider before installing
This skill appears to implement the features it promises, but proceed cautiously. Specific things to consider before installing or running: - Do not follow the README instruction to copy browser cookies (AUTH_TOKEN/CT0) into a .env file unless you fully trust the source—copying session cookies is sensitive and can expose your account. Prefer official OAuth or API keys from the platform. - Verify the Homebrew 'uv' formula origin before installing. If possible, run the Python scripts with a controlled Python environment (venv) instead of installing unknown system packages. - The README and code disagree on storage locations (~/.marketpulse vs ~/.clawdbot); review and set a safe storage path and back up existing files before running scripts that persist local data. - The repository includes a batch_refactor.py that will modify Python files when executed; do not run it unless you audit and trust the modifications. Treat it as a code-changing tool rather than a benign helper. - Additional runtime dependencies (node bird CLI, Twitter auth, third-party Python libraries) are referenced in docs but not declared in metadata—inspect and install dependencies in a sandbox first (or run in an isolated VM/container). If you want to proceed, run the code in an isolated environment, review the scripts you plan to use (especially trend_scanner/signal_scanner/watchlist_manager), and avoid pasting any secrets or copying session cookies into files. If you can provide the brew formula URL for 'uv' and clarify whether any agent will be allowed to execute these scripts autonomously, I can update the assessment and raise/clear specific concerns.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

📊 Clawdis
Binsuv

Install

Install uv (brew)
Bins: uv
brew install uv
latestvk97478bhrq67tnv3bhkdmh5efx8438yg
72downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

MarketPulse Insights v1.0

Comprehensive market analysis platform for equities and digital assets with multi-factor scoring, portfolio management, intelligent alerts, income analysis, and viral trend detection.

New in v1.0

🎯 Core Features

  • Multi-Factor Analysis — 8-dimensional equity scoring framework
  • Digital Asset Support — Top 20 cryptocurrencies with correlation analysis
  • Portfolio Tracking — Real-time P&L and concentration monitoring
  • Smart Alerts — Price targets, stop losses, recommendation changes
  • Income Analytics — Dividend safety, growth rates, yield analysis
  • Trend Detection — Cross-platform viral asset identification
  • Early Signals — Insider activity, analyst actions, market rumors

🔍 Analysis Framework

Equity Analysis (8 Factors):

  1. Earnings Performance (30%) — Surprise and consistency
  2. Financial Health (20%) — Margins, growth, leverage
  3. Professional Sentiment (20%) — Analyst ratings and targets
  4. Historical Behavior (10%) — Past earnings reactions
  5. Market Environment (10%) — VIX, index trends
  6. Industry Position (15%) — Sector relative strength
  7. Price Momentum (15%) — RSI, range position
  8. Market Sentiment (10%) — Fear/greed, positioning

Digital Assets (3 Factors):

  • Market Cap & Category Analysis
  • Bitcoin Correlation (30-day)
  • Momentum Indicators

Quick Start

Asset Analysis

# Standard analysis
uv run {baseDir}/scripts/market_analyzer.py AAPL

# Quick scan (skip deep analysis)
uv run {baseDir}/scripts/market_analyzer.py AAPL --quick

# Multiple assets
uv run {baseDir}/scripts/market_analyzer.py AAPL MSFT GOOGL

# Cryptocurrency
uv run {baseDir}/scripts/market_analyzer.py BTC-USD ETH-USD

Income Analysis

# Single stock dividend analysis
uv run {baseDir}/scripts/income_tracker.py JNJ

# Compare income stocks
uv run {baseDir}/scripts/income_tracker.py JNJ PG KO MCD --format json

Income Metrics:

  • Current Yield & Annual Distribution
  • Payout Ratio (sustainable/elevated/risky)
  • 5-Year Growth Rate (CAGR)
  • Consecutive Increase Years
  • Safety Score (0-100)
  • Income Quality Rating

Watchlist & Alerts

# Add to monitoring list
uv run {baseDir}/scripts/watchlist_manager.py add AAPL

# Set price target alert
uv run {baseDir}/scripts/watchlist_manager.py add AAPL --target 200

# Set stop-loss alert
uv run {baseDir}/scripts/watchlist_manager.py add AAPL --stop 150

# Alert on recommendation change
uv run {baseDir}/scripts/watchlist_manager.py add AAPL --alert-on change

# View monitoring list
uv run {baseDir}/scripts/watchlist_manager.py list

# Check triggered alerts
uv run {baseDir}/scripts/watchlist_manager.py check
uv run {baseDir}/scripts/watchlist_manager.py check --notify  # Notification format

# Remove from list
uv run {baseDir}/scripts/watchlist_manager.py remove AAPL

Alert Types:

  • 🎯 Target Reached — Current price >= target
  • 🛑 Stop Triggered — Current price <= stop
  • 📊 Rating Change — BUY/HOLD/SELL updated

Portfolio Management

# Create portfolio
uv run {baseDir}/scripts/portfolio_manager.py create "Growth Portfolio"

# Add positions
uv run {baseDir}/scripts/portfolio_manager.py add AAPL --quantity 100 --cost 150
uv run {baseDir}/scripts/portfolio_manager.py add BTC-USD --quantity 0.5 --cost 40000

# View portfolio
uv run {baseDir}/scripts/portfolio_manager.py show

# Analyze with period returns
uv run {baseDir}/scripts/market_analyzer.py --portfolio "Growth Portfolio" --period monthly

🔥 Trend Scanner

# Full market scan
python3 {baseDir}/scripts/trend_scanner.py

# Quick scan (no social media)
python3 {baseDir}/scripts/trend_scanner.py --quick

# JSON output
python3 {baseDir}/scripts/trend_scanner.py --format json

Data Sources:

  • 📊 CoinGecko — Trending digital assets
  • 📈 Market Movers — Top gainers/losers
  • 📰 News Aggregation — Finance headlines
  • 📉 Exchange Data — Volume leaders
  • 🐦 Social Media — Sentiment tracking

Output:

  • Trending assets by mention frequency
  • Digital asset highlights with 24h changes
  • Equity movers by category
  • Breaking news with ticker mentions

🎯 Signal Scanner

# Discover early market signals
python3 {baseDir}/scripts/signal_scanner.py

Detection Categories:

  • 🏢 Corporate Actions — M&A speculation, strategic alternatives
  • 👔 Insider Transactions — Executive buying/selling patterns
  • 📊 Analyst Actions — Rating changes, target adjustments
  • 🐦 Social Chatter — Unconfirmed reports, market whispers
  • ⚖️ Regulatory Activity — Investigations, compliance matters

Impact Scoring:

  • Corporate Actions: +5 impact points
  • Insider Buying: +4 impact points
  • Analyst Changes: +3 impact points
  • Social Mentions: +2 impact points
  • High Engagement: +2 bonus points

Recommended: Execute at 07:00 before market open for pre-market signals.

Risk Indicators

  • ⚠️ Earnings Approaching — Warning if < 14 days
  • ⚠️ Recent Spike — Alert if >15% gain in 5 days
  • ⚠️ Overextended — RSI >70 + near highs
  • ⚠️ Risk-Off Environment — Safe-haven flows detected
  • ⚠️ Geopolitical Exposure — Region-specific risks
  • ⚠️ Breaking Developments — Material news detected

Performance Modes

ModeDescriptionExecution Time
StandardComplete analysis5-10 seconds
--no-insiderExclude SEC filings3-5 seconds
--quickSkip deep analysis2-3 seconds

Supported Digital Assets

Top 20 by market cap: BTC, ETH, BNB, SOL, XRP, ADA, DOGE, AVAX, DOT, MATIC, LINK, ATOM, UNI, LTC, BCH, XLM, ALGO, VET, FIL, NEAR

(Use -USD suffix: BTC-USD, ETH-USD)

Data Storage

ComponentStorage Path
Portfolios~/.marketpulse/data/portfolios.json
Watchlists~/.marketpulse/data/watchlist.json
Cache~/.marketpulse/cache/

Important Considerations

  • Market data may have 15-20 minute delays
  • Short interest data updated bi-weekly (FINRA)
  • Insider filings lag 2-3 days (SEC requirements)
  • US market focus (international coverage limited)
  • News scanning uses 1-hour cache with keyword matching

Disclaimer

⚠️ NOT INVESTMENT ADVICE. All analysis provided for informational purposes only. Always consult with a qualified financial professional before making investment decisions. Past performance does not guarantee future results.

Comments

Loading comments...