Yfinance

Fetch live and historical stock data from Yahoo Finance, optimised for Indonesia (IDX) stocks. Use this skill when the user asks about stock prices, historic...

Security Scan

The skill appears to be what it claims — a local FastAPI wrapper around the yfinance library for IDX and global stocks — and its requirements and install steps are proportional to that purpose.

Purpose & Capability

Name/description match the included files and dependencies: main.py implements a FastAPI server that uses the yfinance Python package; required binaries (python3, curl) and the listed Python packages are appropriate and expected.

Instruction Scope

SKILL.md instructs the agent to run a local FastAPI server (uvicorn) and to start it on 0.0.0.0:8000 if not running; it also suggests installing requirements. This is consistent with the connector model but carries operational considerations: running on 0.0.0.0 + CORS allow_origins=["*"] will expose the API to the network if the host/network is configured to allow ingress (the README even instructs opening port 8000/NSG). There are also minor code-quality issues visible (a truncated snippet and a probable typo in get_dividends: ticker.u) which would cause runtime errors but not indicate malicious behavior.

Install Mechanism

Install uses pip/requirements.txt and declares yfinance in the install spec — a standard PyPI-based installation. No arbitrary downloads, URL shorteners, or archive/extract steps are present.

Credentials

The skill requests no environment variables, credentials, or config paths beyond typical Python runtime tools. There are no requests for unrelated secrets or system configuration.

Persistence & Privilege

The skill is not always-enabled and does not request elevated platform privileges. It suggests how to run as a systemd service if the user chooses to deploy it persistently, which is expected for a connector service and not intrinsically a privilege escalation.

Assessment

This skill is coherent with its stated purpose, but consider the following before installing or exposing it: - Network exposure: The server defaults to binding 0.0.0.0 and the app sets CORS allow_origins=["*"]. If you run this on a machine reachable from the internet, requests from any origin can reach it. Run behind a firewall or bind to localhost (127.0.0.1) when used only by your agent, or add authentication if you intend public access. - Isolation: Install Python packages in a virtualenv or container rather than system Python to limit impact of package installation. - Review and test: There are minor bugs/typos visible in the provided source (truncated excerpt and a likely ticker.u typo in the dividends endpoint) — review or run unit tests locally before relying on it in production. - Dependencies: The install relies on PyPI packages (yfinance, fastapi, uvicorn, pandas). Verify you trust these package sources and keep them up to date. - If you plan to publish this connector publicly or open port 8000 on a cloud VM, add API access controls and reduce CORS scope to trusted origins. If you want, I can point out the exact lines to change to bind to localhost, remove permissive CORS, or fix the apparent typo so the service runs more safely and reliably.

YFinance Skill — Indonesia & Global Stock Data

This skill fetches stock market data from Yahoo Finance via a local FastAPI server running at http://localhost:8000. The server must be running before using this skill.

Starting the server

If the server is not running yet, startup logic must:

curl http://localhost:8000/ || (cd ~/.openclaw/workspace/skills/yfinance && uvicorn main:app --host 0.0.0.0 --port 8000 --reload &)

pip install -r requirements.txt

Verify it is up:

curl http://localhost:8000/

Indonesia Stock Tickers

Tickers without a dot suffix are automatically treated as IDX stocks by appending .JK. You do not need to add .JK yourself.

Short form	Resolved ticker	Company
BBCA	BBCA.JK	Bank Central Asia
TLKM	TLKM.JK	Telkom Indonesia
BBRI	BBRI.JK	Bank Rakyat Indonesia
GOTO	GOTO.JK	GoTo Group
ASII	ASII.JK	Astra International

For non-Indonesia stocks, always include the full suffix: AAPL, MSFT, 005930.KS. Use ?auto_jk=false to disable auto-append.

Endpoints

1. Real-time Price

curl "http://localhost:8000/price?ticker=BBCA"

---

2. Historical OHLCV Data

curl "http://localhost:8000/history?ticker=BBCA&period=1y&interval=1d"

---

3. Company Fundamentals

curl "http://localhost:8000/fundamentals?ticker=BBRI"

---

4. Dividend History

curl "http://localhost:8000/dividends?ticker=ASII"

---

5. Stock Split History

curl "http://localhost:8000/splits?ticker=BBCA"

---

Response Format

Every endpoint returns JSON & formatted string.

---

Rules

• Always check API status before querying.
• If server returns error, use startup logic above to launch.
• Never fabricate or guess stock prices. Only report what the API returns.
• If request in Bahasa Indonesia, respond in Bahasa.