Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

UK Stock Market London Stock Exchange

v1.0.0

Get UK (London Stock Exchange, LSE) market data via FinanceAgent on OneKey Gateway.

0· 88·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for ai-hub-admin/uk-stock-market-lse.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "UK Stock Market London Stock Exchange" (ai-hub-admin/uk-stock-market-lse) from ClawHub.
Skill page: https://clawhub.ai/ai-hub-admin/uk-stock-market-lse
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install uk-stock-market-lse

ClawHub CLI

Package manager switcher

npx clawhub@latest install uk-stock-market-lse
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The declared purpose (fetch LSE market data via FinanceAgent on OneKey Gateway) matches the SKILL.md instructions (npx/HTTP calls to agent.deepnlp.org and the aiagenta2z/financeagent API). However, the registry metadata lists no required env vars or install spec while SKILL.md explicitly requires DEEPNLP_ONEKEY_ROUTER_ACCESS and an npm dependency (@aiagenta2z/onekey-gateway). This metadata mismatch is an incoherence.
Instruction Scope
SKILL.md instructs only to set an access key, install/use the onekey gateway npm package, call the named agent API, and shows a curl POST to https://agent.deepnlp.org/agent_router. It does not direct reading of unrelated files, system paths, or transmitting data to unrelated endpoints.
Install Mechanism
Installation is via a public npm package (@aiagenta2z/onekey-gateway) invoked via npm/npx. Using an npm package is expected for this functionality but carries moderate risk if the package/publisher is unverified. No direct downloads from arbitrary URLs are present.
Credentials
Only one secret is required by the SKILL.md (DEEPNLP_ONEKEY_ROUTER_ACCESS), which is reasonable for access to a gateway API. However, the registry metadata incorrectly lists no required env vars—this mismatch could cause users to overlook that they must supply an API key.
Persistence & Privilege
The skill does not request always:true and does not declare system config or other skills' settings. It is user-invocable and can be invoked autonomously (platform default), which is expected for a network-calling integration.
What to consider before installing
This skill appears to do what its description says, but the registry metadata and the SKILL.md disagree: SKILL.md requires an API key (DEEPNLP_ONEKEY_ROUTER_ACCESS) and an npm package (@aiagenta2z/onekey-gateway) while the registry lists none. Before installing or providing credentials, verify: 1) the npm package and its publisher (search the package on npmjs.org and review its maintainer and source code); 2) the legitimacy of the endpoint (agent.deepnlp.org) and the OneKey service; 3) only provide a dedicated, least-privilege API key (not reusable production credentials); 4) prefer installing packages locally or using npx rather than global -g installs; and 5) ask the skill author to update registry metadata to reflect the required env var and dependency. If you cannot validate the npm package or endpoint, do not provide your access key.

Like a lobster shell, security has layers — review code before you run it.

latestvk97bc8j5t6kmgxpaz3c9fe6ezn83wz9w
88downloads
0stars
1versions
Updated 4w ago
v1.0.0
MIT-0

OneKey Gateway

Use one access key to connect to various commercial APIs via the DeepNLP OneKey Agent Router.

Quick Start

Set your OneKey Access Key

export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key

Common settings:

  • unique_id: aiagenta2z/financeagent
  • api_id: get_uk_stock_market_lse

Tool

get_uk_stock_market_lse

Get UK stock market data from the London Stock Exchange (LSE).

Parameters:

  • symbol_list (array of string, required): Stock symbols to query.
    • Use LSE tickers, e.g. "SHEL", "ULVR".
    • Example: ["SHEL", "ULVR"]

Response (JSON):

  • success (boolean): Whether the request succeeded.
  • data (array): List of stock quote objects (fields depend on the upstream data source).
  • message (string, optional): Error message when success=false.

Usage

CLI Usage

## install onekey agent gateway
npm install @aiagenta2z/onekey-gateway

## CLI to Call API and Symbol List
npx onekey agent aiagenta2z/financeagent get_uk_stock_market_lse '{"symbol_list": ["SHEL", "ULVR"]}'

HTTP (curl) Usage

export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key

curl -v -X POST "https://agent.deepnlp.org/agent_router" \
  -H "Content-Type: application/json" \
  -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \
  -d '{
    "unique_id": "aiagenta2z/financeagent",
    "api_id": "get_uk_stock_market_lse",
    "data": {
      "symbol_list": ["SHEL", "ULVR"]
    }
  }'

Comments

Loading comments...