Stock Prices

Query real-time stock prices and market data using the Stock Prices API. Responses are in TOON format—decode with @toon-format/toon. Use when fetching stock...

This skill appears coherent and limited to fetching and decoding stock data. Before installing or using it, verify two things: (1) the API host (https://stock-prices.on99.app) — confirm you trust the operator, check HTTPS/TLS and any privacy or rate-limit policies; (2) the npm package @toon-format/toon — inspect the package source, maintainers, and download counts to ensure it's legitimate. If you plan to use this with private or sensitive data, consider whether the API requires/authenticates requests and avoid embedding secrets in plain query strings. If you need guaranteed provenance, prefer an official/known data provider or self-host a vetted decoder implementation.

Type: OpenClaw Skill Name: stock-prices Version: 1.0.1 The skill is classified as suspicious primarily due to the `pnpm add @toon-format/toon` instruction found in `SKILL.md`. If an AI agent executes this instruction as part of skill setup or execution, it introduces a significant supply chain vulnerability. This allows the agent to install an arbitrary external package, which could lead to arbitrary code execution if the `@toon-format/toon` package (or a typosquatted version) were compromised or malicious. While the stated purpose of the skill (fetching stock prices from `https://stock-prices.on99.app`) appears benign, this capability represents a high-risk action without clear malicious intent from the skill itself, thus classifying it as suspicious rather than malicious.