Questrade
PassAudited by ClawScan on May 1, 2026.
Overview
This is a coherent Questrade trading-support skill that keeps actual order submission manual, but users should recognize it handles high-impact financial workflow details and local trading artifacts.
Before installing, make sure you are comfortable using a skill for financial trade preparation. Keep order submission manual in Questrade, verify every ticket field yourself, keep generated files local or redacted, and do not share passwords, MFA codes, API tokens, cookies, or raw account details with the agent.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If followed incorrectly, the workflow could contribute to an unwanted trade, but the skill requires manual broker-side review and confirmation.
The skill supports a financial trading workflow, which can affect real money, but the artifact explicitly keeps submission manual rather than autonomous.
Submit manually in Questrade Web and record confirmation ID.
Use only with explicit trading intent, independently verify symbol/side/quantity/prices, and submit orders yourself in Questrade only after reviewing the checklist.
Local checklist files may reveal which brokerage account a trade relates to if sensitive output is enabled.
The checklist requires a broker account identifier and may include it in output, but the script masks it by default and only includes the raw value when an explicit sensitive-output option is used.
parser.add_argument("--account-id", required=True, help="Broker account identifier.") ... account_value = args.account_id if args.include_sensitive else mask_identifier(args.account_id)Keep generated files local, leave masking enabled unless necessary, and do not paste broker credentials, MFA codes, cookies, or tokens into prompts or files.
Yahoo Finance may receive the ticker symbols being checked, which could reveal watchlist or trading-interest information.
The snapshot script sends requested ticker symbols to Yahoo Finance for quote retrieval, which is disclosed by the skill purpose and does not include broker credentials.
YAHOO_CHART_URL = "https://query2.finance.yahoo.com/v8/finance/chart/{symbol}"Avoid running snapshots for symbols you consider sensitive, and do not include private account data in ticker inputs or exported files.
Users have less external provenance information to help decide whether they trust the publisher.
The package provenance is not well documented, although the provided artifacts do not show remote installers, hidden dependencies, or suspicious static findings.
Source: unknown Homepage: none
Review the included files before installation and prefer skills from publishers or sources you trust, especially for financial workflows.