Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed market-briefing and alert helper whose external data access, watchlist storage, and optional scheduled delivery fit its stated purpose.
Before installing, understand that your watchlist and alerts may persist in OpenClaw configuration or memory, and scheduled briefings or triggered alerts may be sent through your active messaging channel. Use explicit commands for alerts and review cron jobs if you enable automated delivery.
The skill advertises automated delivery via WhatsApp or Telegram and stores watchlist/alert data, but it does not prominently warn users that preferences and alerts persist and may be sent outbound automatically. This creates a consent and privacy risk: users may not realize their financial interests or alert activity are being retained and transmitted through external messaging channels.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Use the following free public APIs — no API key required:
- **NSE India (unofficial)**: `https://www.nseindia.com/api/` — use browser headers to avoid blocking
- **Yahoo Finance India**: `https://query1.finance.yahoo.com/v8/finance/chart/{SYMBOL}.NS` for NSE stocks
- **BSE India**: `https://api.bseindia.com/BseIndiaAPI/api/` for BSE data
- **Moneycontrol RSS**: `https://www.moneycontrol.com/rss/latestnews.xml` for headlines
For Yahoo Finance, append `.NS` for NSE stocks (e.g. `RELIANCE.NS`) and `.BO` for BSE.
The manual trigger phrase "pulse" is generic enough to collide with ordinary user conversation, especially in a chat environment where users may use the word in unrelated contexts. That can cause the skill to activate unexpectedly and fetch/send market data or perform stateful actions when the user did not intend to invoke it.
No suspicious patterns detected.