Geopolitical Monitor

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears benign, but it is a demo-style local Python monitor that uses mock news data and saves generated reports locally.

Before installing, understand that this is a local demo script: it does not fetch real-time news as provided, it saves JSON reports under `~/shared_memory/geopolitical/`, and any investment conclusions should be independently verified.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A user could mistakenly rely on demo/sample news and sector rankings as current market analysis.

Why it was flagged

The code clearly indicates that the current report is based on simulated news, despite the skill being framed as a geopolitical monitoring and investment-reporting tool.

Skill content
print(f"📊 获取到 {len(MOCK_NEWS)} 条相关新闻(模拟数据)")
Recommendation

Treat the output as a demonstration unless you connect and verify real news sources; do not make investment decisions from the mock report.

What this means

Generated reports may remain available to later sessions or workflows, though the artifacts only show public/mock news and analysis being stored.

Why it was flagged

The script creates a persistent shared-memory-style directory and saves generated reports there.

Skill content
DATA_DIR = Path.home() / "shared_memory" / "geopolitical" ... json.dump(report, f, ensure_ascii=False, indent=2)
Recommendation

Review or delete `~/shared_memory/geopolitical/` if you do not want these reports retained, or change `DATA_DIR` to a less shared location.

What this means

The user may install an unnecessary package from an external package index.

Why it was flagged

The documentation asks the user to install an unpinned external Python package, even though the included script does not currently import it.

Skill content
pip3 install requests
Recommendation

Only install dependencies from trusted sources, consider pinning versions, and skip `requests` unless you add real RSS/API fetching that needs it.