YahooClaw

Yahoo Finance API integration for OpenClaw. Use when users ask for stock prices, company financials, historical data, dividends, or market data. Supports rea...

This skill largely looks like a typical Yahoo Finance wrapper (it imports the standard yahoo-finance2 npm package and provides quote/history/news/technical modules), but there are multiple inconsistencies you should resolve before installing or running it in a production agent: - Documentation vs. code mismatch: README and SKILL.md claim features (automatic failover, APIManager, smart caching, Alpha Vantage fallback) that are either not implemented or reference missing files (e.g., APIManager, src/yahoo-finance.js). Expect runtime errors or incomplete behavior. - Install ambiguity: The registry says 'no install spec' but package.json declares dependencies. Ensure npm install (or equivalent) is run in a controlled environment so dependencies are present; do not run arbitrary install commands on a sensitive host without review. - Prompt-injection artifact: SKILL.md contained unicode control characters flagged by the scanner. Inspect SKILL.md in a text editor that can show hidden characters; remove or sanitize them if unnecessary. - Safety checks: Review the source code yourself (or have a developer do so). Verify which network endpoints are called (yahoo-finance2 contacts Yahoo Finance endpoints) and that no unexpected endpoints or credential exfiltration exist. Run the skill in a sandboxed environment first, and monitor network traffic and failures. - If you rely on the advertised advanced features (caching, failover, APIManager), request clarification from the owner or wait for a version where code and docs are consistent. If you proceed, run npm install and tests in an isolated environment and verify expected behavior before enabling it in an agent that has access to sensitive data.

Type: OpenClaw Skill Name: yahoo-claw Version: 0.1.1 The YahooClaw skill bundle is a functional integration for Yahoo Finance, providing real-time quotes, historical data, and technical analysis. The code uses the legitimate 'yahoo-finance2' NPM package and implements local logic for sentiment analysis and financial indicators (MA, RSI, MACD, etc.). While there are minor inconsistencies between the documentation and the code (e.g., ESM vs. CommonJS usage) and a missing utility file (src/api/APIManager.js) referenced in the test script, the provided logic is transparent, aligned with the stated purpose, and contains no evidence of malicious intent, data exfiltration, or prompt injection.