AgentPit 财经综合分析

ReviewAudited by ClawScan on May 10, 2026.

Overview

This is a coherent stock-analysis integration, but it requires an AgentPit consumer key and can make paid API calls to AgentPit when the user chooses an analysis.

Before installing, make sure you are comfortable giving this skill your AgentPit consumer key and allowing it to make paid API calls to api.agentpit.io for selected stock analyses. Keep the key private, monitor billing, and delete ~/.openclaw/secrets/agentpit.cpk if you want to revoke local access.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anyone or any agent process with access to this key could potentially make calls billed to the user’s AgentPit account.

Why it was flagged

The skill requires and stores an AgentPit consumer key, then uses it as a Bearer token for authenticated, billed API calls. This is disclosed and aligned with the integration, but it is still account access.

Skill content
需要用户的 consumerKey... Authorization: Bearer $AGENTPIT_CPK ... 保存到本地 `~/.openclaw/secrets/agentpit.cpk`(权限 600,仅当前用户可读)
Recommendation

Only provide the key if you trust the AgentPit service and this skill. Rotate the key if exposed, and delete ~/.openclaw/secrets/agentpit.cpk if you no longer want the skill to use it.

What this means

Selected analyses send the requested ticker to AgentPit and can incur usage charges.

Why it was flagged

The skill invokes remote analysis endpoints using curl and discloses that calls are billed. It also instructs the agent to ask the user which systems to run before making calls.

Skill content
请选择(输入数字,可多选,如"1 3"或"全部") ... curl -s -X POST "https://api.agentpit.io/api/v1/skill-invoke/stock-analyze" ... 每次调用末尾附一句:"本次已按用量从你的 agentpit 账户扣费"
Recommendation

Confirm which analysis systems you want before authorizing calls, and review billing at the AgentPit account page if costs matter.