Stock Monitor
Analysis
This appears to be a purpose-aligned stock alert monitor, but users should know it runs a background process and queries third-party market/news services.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
nohup python3 "$SCRIPT_DIR/monitor_daemon.py" > "$LOG_DIR/monitor.log" 2>&1 &
The control script starts a background daemon and records logs/PID under $HOME/.stock_monitor. This is disclosed and purpose-aligned, but it will continue running until stopped.
Required binaries (all must exist): none ... No install spec — this is an instruction-only skill.
The provided artifacts include shell/Python scripts that invoke python3 and import requests, so setup requirements are under-declared even though the behavior is visible and purpose-aligned.
# Stock Monitor Pro - 全功能智能投顾系统 ... 💡 Kimi建议: 🚀 多条件共振，趋势强劲，可考虑继续持有或分批减仓。
The skill frames itself as an investment-advice system and provides suggested trading actions. It also includes cautionary usage tips, so this is a trust/decision-making note rather than evidence of malicious behavior.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
url = f"https://searchapi.eastmoney.com/api/suggest/get" ... params = {"input": name, "type": 14, "count": limit}The analyser sends stock names/symbol-related queries to third-party financial/news providers. This is expected for the feature, but it creates an external data boundary for the user's watchlist.