Openbb Terminal

WarnAudited by ClawScan on May 10, 2026.

Overview

This finance skill is mostly coherent for market data and backtesting, but it also includes possible broker/live-trading and sensitive-credential authority without clear approval, limit, or credential boundaries.

Install only if you intend to use a finance data/backtesting assistant and are comfortable reviewing setup commands. Keep it in data/backtest mode unless you explicitly want live trading, and do not connect broker or paid-provider credentials without clear limits, manual approvals, and a way to revoke access.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If connected to a broker or trading environment, a broad instruction like running a strategy could lead the agent toward order-placement workflows that affect real positions or money.

Why it was flagged

This shows the skill is not limited to data retrieval or backtesting; it includes trading execution and order sequencing semantics without explicit live-trade confirmation or limits.

Skill content
`data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization` ... `SL-01` Execute sell orders before buy orders in every trading cycle
Recommendation

Use it for data analysis and backtesting by default. Require explicit manual confirmation, paper-trading mode, position limits, and code review before any broker-connected or live order action.

What this means

Users may not know what broker, paid data-provider, or account credentials the agent may need, how they will be used, or what authority they grant.

Why it was flagged

The artifact signals purchase and sensitive-credential capability while declaring no credential requirements or scoped credential handling contract.

Skill content
Required env vars: none; Primary credential: none ... Capability signals: can-make-purchases; requires-sensitive-credentials
Recommendation

Do not provide broker or paid-provider credentials unless the exact provider, scope, storage location, and allowed actions are documented and you can revoke the access.

What this means

Installing packages from the network can change the local Python environment and runs third-party code.

Why it was flagged

The reference setup uses an unpinned package install and local initialization even though the registry lists no formal install spec. This is expected for ZVT-based finance workflows but should be user-reviewed.

Skill content
on_fail: Run: python3 -m pip install zvt then re-run: python3 -m zvt.init_dirs
Recommendation

Install ZVT manually from a trusted source, prefer pinned versions or a virtual environment, and review setup commands before running them.