Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

US Stock Market NYSE NASDAQ DOW

v1.0.0

Get US stock market data (NYSE, NASDAQ, and major indices) via FinanceAgent on OneKey Gateway.

0· 104·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for ai-hub-admin/us-stock-market-nyse-nasdaq-dow.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "US Stock Market NYSE NASDAQ DOW" (ai-hub-admin/us-stock-market-nyse-nasdaq-dow) from ClawHub.
Skill page: https://clawhub.ai/ai-hub-admin/us-stock-market-nyse-nasdaq-dow
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install us-stock-market-nyse-nasdaq-dow

ClawHub CLI

Package manager switcher

npx clawhub@latest install us-stock-market-nyse-nasdaq-dow
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (get US stock data via OneKey FinanceAgent) align with the declared npm dependency and the described API calls to the OneKey agent_router endpoint.
Instruction Scope
SKILL.md only instructs setting an OneKey API key, installing/using the @aiagenta2z/onekey-gateway npm package, and calling the OneKey gateway via CLI or curl. There are no instructions to read unrelated system files, access unrelated env vars, or exfiltrate data to unexpected endpoints beyond agent.deepnlp.org/OneKey.
Install Mechanism
Install is an npm package (@aiagenta2z/onekey-gateway) with suggested global install (npm -g). Installing npm packages is expected for this use-case but is a moderate-risk action compared with instruction-only skills; users should verify the package publisher and contents before running a global install.
!
Credentials
SKILL.md requires DEEPNLP_ONEKEY_ROUTER_ACCESS (OneKey Gateway API key), which is appropriate for the described gateway calls — but the registry metadata earlier lists no required env vars. This mismatch (metadata says none, runtime doc says key required) is an incoherence that should be resolved.
Persistence & Privilege
Skill is instruction-only with no install script that persists special privileges, and flags show always:false. It does not request permanent agent presence or modify other skills.
What to consider before installing
This skill appears to do what it claims (query stock quotes via the OneKey/FinanceAgent gateway). Before installing or using it: (1) confirm the discrepancy between the registry metadata and SKILL.md — SKILL.md requires DEEPNLP_ONEKEY_ROUTER_ACCESS but the registry shows no required env; ask the publisher to clarify. (2) Verify and inspect the npm package @aiagenta2z/onekey-gateway (publisher, source repository, recent releases) before running npm -g install; prefer a non-global install if possible. (3) Only provide an API key to services you trust; the key gives the skill access to the OneKey gateway under your account, so consider using a scoped or limited key. (4) Check that the endpoint agent.deepnlp.org and the unique_id/api_id are what you expect for the FinanceAgent integration. If the publisher can't explain the metadata mismatch or you don't trust the npm package or gateway, do not install.

Like a lobster shell, security has layers — review code before you run it.

latestvk97bsgykg0ydw1rdqeyr1bq55n83wbng
104downloads
0stars
1versions
Updated 4w ago
v1.0.0
MIT-0

OneKey Gateway

Use one access key to connect to various commercial APIs via the DeepNLP OneKey Agent Router.

Quick Start

Set your OneKey Access Key

export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key

Common settings:

  • unique_id: aiagenta2z/financeagent
  • api_id: get_us_stock_market_nyse_nasdaq_dow

Tool

get_us_stock_market_nyse_nasdaq_dow

Get US stock market data (NYSE, NASDAQ, DOW).

Parameters:

  • symbol_list (array of string, required): Stock symbols to query.
    • Use standard US tickers, e.g. "TSLA", "MSFT", "GOOG".
    • Example: ["TSLA", "MSFT", "GOOG"]

Response (JSON):

  • success (boolean): Whether the request succeeded.
  • data (array): List of stock quote objects (fields depend on the upstream data source).
  • message (string, optional): Error message when success=false.

Usage

CLI Usage

## install onekey agent gateway
npm install @aiagenta2z/onekey-gateway

## CLI to Call API and Symbol List
npx onekey agent aiagenta2z/financeagent get_us_stock_market_nyse_nasdaq_dow '{"symbol_list": ["TSLA", "MSFT", "GOOG"]}'

HTTP (curl) Usage

export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key

curl -v -X POST "https://agent.deepnlp.org/agent_router" \
  -H "Content-Type: application/json" \
  -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \
  -d '{
    "unique_id": "aiagenta2z/financeagent",
    "api_id": "get_us_stock_market_nyse_nasdaq_dow",
    "data": {
      "symbol_list": ["TSLA", "MSFT", "GOOG"]
    }
  }'

Comments

Loading comments...