初始版本:支持 28+ 新闻源、10+ LLM 模型、情感分析、图表生成、数据持久化、定时任务

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a coherent finance-news analysis skill, but users should notice its optional LLM API use, local data storage, package installation, and scheduled-task features.

Before installing, decide whether you want cloud or local LLM analysis, configure only the needed API key, use a virtual environment for dependencies, and enable scheduled jobs only if you are comfortable with repeated future runs and possible API costs.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using this skill with cloud LLMs may consume paid API quota and gives the selected provider access to the news text and analysis prompt.

Why it was flagged

The skill reads LLM provider API keys from environment variables to call OpenAI, Anthropic, DashScope, Qianfan, Zhipu, or Ollama-compatible endpoints.

Skill content
api_key = os.getenv('OPENAI_API_KEY') ... return OpenAI(api_key=api_key), 'openai'
Recommendation

Configure only the API key for the provider you plan to use, prefer low-privilege or budget-limited keys where possible, and avoid passing private financial notes unless you intend to send them to that provider.

What this means

News titles, summaries, sources, and possibly user-selected tickers or keywords may be shared with the chosen model provider.

Why it was flagged

The skill embeds fetched or user-provided news content into prompts sent to external or local LLM providers for analysis.

Skill content
"**新闻标题**: {title}\n**新闻摘要**: {summary}\n**新闻来源**: {source}"
Recommendation

Use a local model for sensitive analysis, or review what input data is being analyzed before using a cloud LLM provider.

What this means

Historical analysis results and any configured watchlist-related output may persist locally and influence later trend reports.

Why it was flagged

The skill stores news items, sentiment analysis, impact assessments, key points, and generated briefings in a local SQLite database.

Skill content
class FinanceNewsDB: ... def __init__(self, db_path: str = "finance_news.db") ... CREATE TABLE IF NOT EXISTS news ... sentiment_analysis ... briefings
Recommendation

Keep the database in a location you control, periodically delete or export data as needed, and treat reports generated from stored history as advisory rather than authoritative.

What this means

If enabled, the skill may run repeatedly in the future, fetch news, call LLM APIs, and create reports without a fresh manual command each time.

Why it was flagged

The skill includes a scheduler that can add recurring daily or weekly runs, along with list, manual run, and remove commands.

Skill content
python scripts/scheduler.py add --time "08:00" --daily ... python scripts/scheduler.py remove --id 1
Recommendation

Only add scheduled jobs intentionally, verify the task list after setup, and remove scheduled jobs when you no longer want automated reports.

What this means

Installing dependencies or running remote setup scripts changes the local environment and relies on external package/source integrity.

Why it was flagged

The setup docs ask users to install third-party packages and optionally run a remote Ollama installation script.

Skill content
pip install requests beautifulsoup4 jinja2 pyyaml ... curl -fsSL https://ollama.com/install.sh | sh
Recommendation

Install dependencies in a virtual environment, review remote install scripts before running them, and prefer pinned or trusted package versions for production use.