magpie
PassAudited by ClawScan on May 13, 2026.
Overview
The skill appears coherent and limited to a local Chinese stock-monitoring daemon, but users should notice that it can change local watchlists and alerts and depends on an external daemon not included in the review.
This looks reasonable for local A-share monitoring. Use it only if you trust the separately installed magpie daemon, and review any watchlist or alert changes before letting the agent apply them.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If invoked on the wrong stock code or threshold, the agent could change the user's local monitoring setup.
The skill documents local API calls that can add or remove watchlist entries and add or disable alert rules.
curl -s -X POST ... /api/v1/watchlist ... curl -s -X DELETE "http://127.0.0.1:17891/api/v1/watchlist/600519" ... curl -s -X POST ... /api/v1/alerts ... curl -s -X DELETE "http://127.0.0.1:17891/api/v1/alerts/1"
Confirm stock codes, thresholds, and delete/disable actions with the user before changing watchlists or alerts.
The skill's safety depends on the separately installed local magpie daemon, which was not reviewed here.
The reviewed artifact only contains instructions and does not include the local daemon code it depends on.
Source: unknown; Homepage: none; No install spec — this is an instruction-only skill.
Only use this skill with a magpie daemon you installed from a trusted source and understand how to stop or update.
Responses may include private portfolio/watchlist preferences or alert history from the local daemon.
The skill can retrieve persistent local watchlist, alert history, and digest data that may reveal the user's financial interests.
GET /watchlist ... /api/v1/alerts/history?days=7 ... /api/v1/digest?type=evening
Treat outputs from watchlist, alert-history, and digest endpoints as private financial monitoring data.