ClawHub

Twelve Data Market API

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Twelve Data API helper, with the main caveat that many examples put the API key in URLs.

Install only if you intend to use Twelve Data market-data services. Store TWELVEDATA_API_KEY securely, prefer the Authorization header examples over apikey-in-URL examples, avoid sharing logs or command history containing full request URLs, and monitor API credit usage.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (16)

Missing User Warnings

Low
Confidence
94% confidence
Finding
The skill documentation repeatedly instructs use of an API key with a third-party service but does not clearly warn users that their credentials and requested symbols/data will be transmitted off-platform. This is a real but low-severity issue because it can lead to uninformed credential disclosure and poor secret-handling practices, especially where query-parameter authentication is shown.

External Transmission

Medium
Category
Data Exfiltration
Content
1. Query parameter

```bash
curl "https://api.twelvedata.com/price?symbol=AAPL&apikey=${TWELVEDATA_API_KEY}"
```

2. HTTP header (recommended by docs)
Confidence
92% confidence
Finding
https://api.twelvedata.com/

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl -H "Authorization: apikey ${TWELVEDATA_API_KEY}" \
  "https://api.twelvedata.com/price?symbol=AAPL"
```

Notes:
Confidence
82% confidence
Finding
https://api.twelvedata.com/

External Transmission

Medium
Category
Data Exfiltration
Content
### 1) Latest price (`/price`, 1 credit/symbol)

```bash
curl "https://api.twelvedata.com/price?symbol=AAPL&apikey=${TWELVEDATA_API_KEY}"
```

### 2) Real-time quote (`/quote`, 1 credit/symbol)
Confidence
91% confidence
Finding
https://api.twelvedata.com/

External Transmission

Medium
Category
Data Exfiltration
Content
### 2) Real-time quote (`/quote`, 1 credit/symbol)

```bash
curl "https://api.twelvedata.com/quote?symbol=AAPL&apikey=${TWELVEDATA_API_KEY}"
```

### 3) Historical OHLCV (`/time_series`, 1 credit/symbol)
Confidence
91% confidence
Finding
https://api.twelvedata.com/

External Transmission

Medium
Category
Data Exfiltration
Content
### 3) Historical OHLCV (`/time_series`, 1 credit/symbol)

```bash
curl "https://api.twelvedata.com/time_series?symbol=AAPL&interval=1day&outputsize=100&apikey=${TWELVEDATA_API_KEY}"
```

Common `interval` values: `1min`, `5min`, `15min`, `30min`, `1h`, `2h`, `4h`, `1day`, `1week`, `1month`
Confidence
91% confidence
Finding
https://api.twelvedata.com/

External Transmission

Medium
Category
Data Exfiltration
Content
### 4) Symbol discovery (`/symbol_search`, 1 credit/request)

```bash
curl "https://api.twelvedata.com/symbol_search?symbol=apple&apikey=${TWELVEDATA_API_KEY}"
```

### 5) Technical indicators (typically 1 credit/symbol)
Confidence
90% confidence
Finding
https://api.twelvedata.com/

External Transmission

Medium
Category
Data Exfiltration
Content
RSI:

```bash
curl "https://api.twelvedata.com/rsi?symbol=AAPL&interval=1day&time_period=14&series_type=close&apikey=${TWELVEDATA_API_KEY}"
```

MACD:
Confidence
90% confidence
Finding
https://api.twelvedata.com/

External Transmission

Medium
Category
Data Exfiltration
Content
MACD:

```bash
curl "https://api.twelvedata.com/macd?symbol=AAPL&interval=1day&series_type=close&apikey=${TWELVEDATA_API_KEY}"
```

### 6) Fundamentals (plan-gated, higher credits)
Confidence
90% confidence
Finding
https://api.twelvedata.com/

External Transmission

Medium
Category
Data Exfiltration
Content
Earnings (`/earnings`, Grow+):

```bash
curl "https://api.twelvedata.com/earnings?symbol=AAPL&apikey=${TWELVEDATA_API_KEY}"
```

Statistics (`/statistics`, Pro+):
Confidence
90% confidence
Finding
https://api.twelvedata.com/

External Transmission

Medium
Category
Data Exfiltration
Content
Statistics (`/statistics`, Pro+):

```bash
curl "https://api.twelvedata.com/statistics?symbol=AAPL&apikey=${TWELVEDATA_API_KEY}"
```

Income statement (`/income_statement`, Pro+):
Confidence
90% confidence
Finding
https://api.twelvedata.com/

External Transmission

Medium
Category
Data Exfiltration
Content
Income statement (`/income_statement`, Pro+):

```bash
curl "https://api.twelvedata.com/income_statement?symbol=AAPL&apikey=${TWELVEDATA_API_KEY}"
```

Balance sheet (`/balance_sheet`, Pro+):
Confidence
90% confidence
Finding
https://api.twelvedata.com/

External Transmission

Medium
Category
Data Exfiltration
Content
Balance sheet (`/balance_sheet`, Pro+):

```bash
curl "https://api.twelvedata.com/balance_sheet?symbol=AAPL&apikey=${TWELVEDATA_API_KEY}"
```

Cash flow (`/cash_flow`, Pro+):
Confidence
90% confidence
Finding
https://api.twelvedata.com/

External Transmission

Medium
Category
Data Exfiltration
Content
Cash flow (`/cash_flow`, Pro+):

```bash
curl "https://api.twelvedata.com/cash_flow?symbol=AAPL&apikey=${TWELVEDATA_API_KEY}"
```

Dividends:
Confidence
90% confidence
Finding
https://api.twelvedata.com/

External Transmission

Medium
Category
Data Exfiltration
Content
Dividends:

```bash
curl "https://api.twelvedata.com/dividends?symbol=AAPL&start_date=1970-01-01&apikey=${TWELVEDATA_API_KEY}"
```

## Batch and Multi-Asset Examples
Confidence
90% confidence
Finding
https://api.twelvedata.com/

External Transmission

Medium
Category
Data Exfiltration
Content
Batch symbols on supported endpoints:

```bash
curl "https://api.twelvedata.com/time_series?symbol=AAPL,EUR/USD,ETH/BTC:Huobi&interval=1min&apikey=${TWELVEDATA_API_KEY}"
```

Asset symbol patterns:
Confidence
90% confidence
Finding
https://api.twelvedata.com/

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal