Portfolio Tracker
PassAudited by ClawScan on May 10, 2026.
Overview
The skill is coherent for portfolio tracking and shows no exfiltration or destructive behavior, but it contains exact personal holdings and uses browser automation, so it should be kept private.
Install only if you are comfortable storing Vish's exact portfolio holdings inside the skill files and letting the agent use browser automation to fetch Yahoo Finance data. Keep it private, use a dedicated browser profile, and treat generated rebalancing or averaging suggestions as informational rather than financial advice.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone or any agent with access to the skill files can see Vish's exact portfolio positions, and the data may be included in generated responses or tracker files.
The skill packages exact stock and crypto holdings as persistent reference data for the agent to read and reuse during portfolio analysis.
TSLA: 30.18 shares ... BTC: 0.0164 ... SHIB: 20,068,122.52
Use this only in a private workspace, avoid sharing the skill package publicly with real holdings, and remove or anonymize positions before distribution.
The agent could view Yahoo Finance pages through that browser profile while updating the portfolio, which may include account-specific page content if the profile is signed in.
The workflow uses a named Chrome profile for browser automation. If that profile contains logged-in sessions, the agent may interact with pages in that session context.
Browser automation: Attach Chrome extension (profile=open-claw-chrome) to Yahoo Finance
Use a dedicated browser profile for this skill and avoid keeping unrelated sensitive sessions open in that profile.
The generated tracker file could be updated with incorrect or stale market data if the page parsing is wrong, but there is no evidence of trading, deletion, or account mutation.
The skill directs the agent to use browser automation and modify a local tracker file. This is purpose-aligned, but it is still a local file mutation based on external web data.
browser navigate https://finance.yahoo.com/quote/[TICKER] ... edit portfolio-tracker.md with new table
Review generated portfolio updates before relying on them, and keep backups if the tracker file is important.