Portfolio Tracker

Automatically tracks and analyzes Vish's stock and crypto portfolio using live Yahoo Finance data, providing updates, performance summaries, and rebalancing...

This skill appears to do what it says (read a local holdings file, scrape Yahoo Finance, update a portfolio file), but exercise caution before installing/using it: - The SKILL.md asks the agent to 'attach' an existing Chrome profile (profile=open-claw-chrome). That can give the automation access to cookies, logged-in sessions, and other browser data unrelated to portfolio tracking. Confirm what 'attach' means in your environment and whether you are comfortable granting that access. - The holdings file contains real financial and crypto positions. Only run this skill if you trust the skill owner and the runtime environment; consider using a sanitized/test holdings file first. - The included Python script is small and appears harmless (it just reads and parses the local holdings file). Still review any code before use and run in a sandbox if possible. - If you need to mitigate risk: create a dedicated browser profile with no saved logins and only the minimal extension/context required; or modify the workflow to use an ephemeral browser context instead of attaching an existing profile. If the author documents why a profile must be attached (and declares the config path or permission), or if the skill is updated to launch a fresh browser context instead of attaching an existing profile, my concern would be reduced.

Type: OpenClaw Skill Name: portfolio-tracker Version: 0.0.1 The OpenClaw skill 'portfolio-tracker' is designed to automate portfolio tracking using browser automation on Yahoo Finance. The `SKILL.md` clearly outlines the workflow, which involves reading local holdings from `references/portfolio-holdings.md`, navigating to Yahoo Finance via browser actions, snapshotting data, and updating a local `portfolio-tracker.md` file. The `scripts/update-portfolio.py` script correctly reads and parses the local holdings file as described. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection intended to subvert the agent's behavior for harmful purposes. The 'TODO' section in `SKILL.md` is clearly developer guidance and not an instruction for the AI agent.