Economic Calendar Fetcher

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: economic-calendar-fetcher Version: 0.1.0 The skill bundle is designed to fetch economic calendar data from the Financial Modeling Prep (FMP) API. The `SKILL.md` provides clear, detailed instructions to the AI agent, focusing solely on the skill's stated purpose without any prompt injection attempts to deviate from instructions, hide actions, or access unrelated sensitive data. The `scripts/get_economic_calendar.py` script uses standard Python libraries (`urllib.request`, `os`, `json`) to make HTTP GET requests to the legitimate FMP API endpoint (`https://financialmodelingprep.com/api/v3/economic_calendar`), retrieve an API key from an environment variable or argument, and process the response. There is no evidence of data exfiltration beyond the API key to the intended FMP service, malicious execution of arbitrary code, persistence mechanisms, or obfuscation. All functionalities, including network access and API key handling, are directly aligned with the skill's benign objective.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

You may need to provide an FMP API key, which will be used to make requests to Financial Modeling Prep.

Why it was flagged

The script requires an FMP API key and sends it to the documented FMP endpoint as a request parameter. This credential use is expected for the stated integration, but it is still account/API access users should notice.

Skill content

api_key = args.api_key or get_api_key()
...
params = {
    'from': from_date,
    'to': to_date,
    'apikey': api_key
}

Recommendation

Use a dedicated FMP API key with the minimum subscription/access needed, and avoid sharing unrelated credentials.

Note

ASI02: Tool Misuse and Exploitation

What this means

The skill contacts the external FMP service and can save a report file if an output path is provided.

Why it was flagged

The helper performs a network request and can write results to a user-specified output path. Both behaviors are disclosed and aligned with fetching and saving an economic calendar report.

Skill content

with urllib.request.urlopen(url) as response:
...
if args.output:
    with open(args.output, 'w', encoding='utf-8') as f:
        f.write(output)

Recommendation

Run it only for intended date ranges and choose output paths carefully to avoid overwriting files.