research analyst

Minimal local stock/crypto analysis (5 core scripts bundled). Public APIs only, zero credentials, no subprocess, ClawHub reviewed.

This skill appears internally consistent with its description, but review and basic precautions are recommended before use: 1) Inspect the bundled Python scripts (they are included) if you want assurance; the package claims no eval/exec/subprocess usage and the code snippets provided match that. 2) Install dependencies in an isolated virtual environment or container (python -m venv / docker) to limit supply-chain risk from PyPI. 3) Run the provided verify_install.sh to confirm the expected files and simple pattern checks. 4) Be aware portfolio data is stored locally (~/.clawdbot/skills/research-analyst/portfolios.json) — if that contains sensitive financial data, restrict file permissions or set CLAWDBOT_STATE_DIR to a secure location. 5) If you require stronger assurance, manually verify the dependency hashes on PyPI and review full script contents (especially network endpoints) before running.

Type: OpenClaw Skill Name: research-analyst Version: 1.0.54 The research-analyst skill bundle is a well-documented financial analysis toolset that prioritizes security through a 'minimal' architecture. It utilizes bundled Python scripts and standard PyPI dependencies (yfinance, pandas, requests) to perform stock, crypto, and dividend analysis using public APIs via read-only GET requests. The code explicitly avoids high-risk operations such as subprocess calls, eval/exec functions, and credential requirements, and it includes a dedicated verification script (verify_install.sh) and comprehensive security policy (SECURITY.md) to facilitate user auditing. No indicators of data exfiltration, malicious persistence, or prompt injection were found.