Fin Ai

ReviewAudited by ClawScan on May 17, 2026.

Overview

The skill is mostly purpose-aligned, but its preview mode can leave temporary copies of sensitive portfolio data despite saying preview does not write temporary files.

Review the preview behavior before installing. This skill does not appear to trade or access brokerage accounts, but it handles sensitive portfolio data, writes local holdings/snapshots/history, calls external quote providers, and may leave temporary preview copies. Prefer preview first, confirm real writes only after checking results, and delete any portfolio-workflows-safe-run temp directories if you do not want leftover copies.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI09: Human-Agent Trust Exploitation

What this means

A user may choose preview believing nothing is written, while sensitive portfolio files can still be copied locally.

Why it was flagged

This promises that preview mode does not create temporary files or temporary paths, but the provided refresh implementation creates a temporary portfolio copy. That mismatch can cause users to underestimate local data residue.

Skill content

预演时：
- 结果直接展示在对话里（用户可读的摘要：总资产、盈亏、账户组、warnings）
- 不写临时文件，不生成临时文件路径

Recommendation

Either change preview mode to avoid temp files, or update the instructions to clearly disclose temp copies and automatically clean them after use.

Medium

#ASI06: Memory and Context Poisoning

What this means

Sensitive financial data can be left in a temporary directory even if the user only asked for a preview.

Why it was flagged

When confirm_write is false, the code copies the whole portfolio directory into a temporary working directory. The provided code does not show cleanup, so holdings/snapshots/history may remain duplicated after preview.

Skill content

temp_parent = Path(tempfile.mkdtemp(prefix="portfolio-workflows-safe-run-"))
working_dir = temp_parent / "portfolio"
shutil.copytree(resolved_portfolio_dir, working_dir)

Recommendation

Delete preview temp directories after use, minimize what is copied, and prefer in-memory previews or explicit user-approved temp storage.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Third-party quote providers may learn which securities are in the analyzed portfolio, though the code shown does not send quantities or cost basis.

Why it was flagged

The skill fetches market data from external providers using tickers from the portfolio. This is purpose-aligned, but it means held or watched symbols may be sent to third-party market-data services.

Skill content

yahoo_base = config.get("yahoo_base", "https://query1.finance.yahoo.com/v8/finance/chart") ... "https://fund.eastmoney.com/pingzhongdata/{code}.js" ... "https://stooq.com/q/l/"

Recommendation

Use a user-supplied market_context file or trusted proxy/config if ticker privacy matters.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If invoked directly or after confirmation, the skill can change local portfolio records and derived history.

Why it was flagged

The lower-level holdings sync helper writes updated holdings directly when called. This is expected for the skill, but users should ensure the agent uses the preview/confirmation workflow before real portfolio data is changed.

Skill content

holdings_path = write_holdings(portfolio_dir, updated_holdings)

Recommendation

Use the main refresh workflow in preview mode first, review warnings and summaries, then allow confirmed writes only when the results look correct.