stock-analysis
PassAudited by ClawScan on May 10, 2026.
Overview
This skill appears to do the advertised stock-market analysis, but users should notice its local Python execution, unpinned package install, hard-coded file paths, and optional hourly scheduled agent task.
This skill looks safe to review as a stock-data/reporting helper, not a trading bot. Before installing, use a virtual environment for the Python packages, check or change hard-coded file paths, enable the hourly cron task only if you really want ongoing analysis, and treat all stock recommendations as informational rather than financial advice.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Running the installer can modify the user's Python environment and depends on whatever versions are currently served by package repositories.
The user-run installer installs third-party packages without version pinning. This is aligned with the stock-data purpose, but it relies on the current package supply chain.
subprocess.run([sys.executable, "-m", "pip", "install", "akshare", "pandas"], check=True)
Install in a virtual environment, verify package sources, and prefer pinned dependency versions or a declared install spec.
If enabled, the agent may keep running scheduled stock-analysis prompts and producing recommendations on an hourly basis.
The skill documents an optional recurring hourly agent task. This persistence is disclosed and purpose-aligned for automatic stock analysis, but it continues until removed.
openclaw cron add ... --cron "0 * * * *" ... --agent main ... --session isolated
Only create the cron task if ongoing analysis is desired, and use the documented cron list/remove commands to review or stop it.
If this script runs on a matching Windows path, it may create or overwrite stock_data.csv on the Desktop.
An auxiliary script writes market data to a fixed Desktop path outside the skill directory. This is related to the skill's purpose, but it is not scoped to a user-approved or portable location.
df.to_csv('C:/Users/chenyaoan/Desktop/stock_data.csv', index=False, encoding='utf-8-sig')Change the output to a user-selected path or a skill-local data directory, and ask before overwriting files.
Some documented commands may fail or cause confusion about which reviewed script should be run.
The documentation presents quick_analysis.py as a primary script, but the supplied file manifest does not include that file, indicating a packaging/documentation mismatch rather than malicious behavior.
python ~/.openclaw/skills/stock-analysis/scripts/quick_analysis.py
The publisher should align the documentation with the manifest or include the referenced scripts.