Twelve Data Market API

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent instruction-only Twelve Data API guide that requires an expected API key and external API calls, with no hidden code or mismatched behavior shown.

This skill appears safe to install if you intend to use Twelve Data. Protect your TWELVEDATA_API_KEY, prefer header-based authentication, and remember that requests may consume provider credits or reveal the market symbols you query to Twelve Data.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Using the skill can consume Twelve Data credits or access endpoints allowed by the user's API plan.

Why it was flagged

The skill requires a provider API key, giving the agent access to the user's Twelve Data account quota and plan-gated endpoints.

Skill content

requires:\n  env:\n    - TWELVEDATA_API_KEY\nprimaryEnv: TWELVEDATA_API_KEY

Recommendation

Store the key as an environment secret, monitor usage in the Twelve Data dashboard, and avoid sharing the key in prompts, logs, or public outputs.

Info

#ASI07: Insecure Inter-Agent Communication

What this means

Symbols, date ranges, requested indicators, and the API key are sent to Twelve Data when the skill is used.

Why it was flagged

The skill communicates with an external market-data provider; this is disclosed and directly matches the stated purpose.

Skill content

- REST API: `https://api.twelvedata.com`\n- WebSocket: `wss://ws.twelvedata.com`

Recommendation

Use it for intended market-data lookups and prefer the documented Authorization header over query-string API keys when possible.