Quiver Quantitative

Query alternative financial data from Quiver Quantitative (Congress trading, Lobbying, Government Contracts, Insider transactions). Use this to track politician stock trades or unconventional market signals.

This skill appears to be a straightforward Quiver API client, but there are a few red flags you should address before installing or running it: - QUIVER_API_KEY is required: The code and SKILL.md require QUIVER_API_KEY, but the registry metadata does not list any required env vars. Do not supply other unrelated secrets. Provide only a Quiver API key and verify its scope. - Missing dependency declaration: The script imports the third-party package 'quiverquant' but there is no install spec. Make sure the runtime environment already has this package installed from a trusted source (e.g., PyPI) or add an explicit install step that pins a known-good version. - Verify origin and checksum: The skill's source/homepage is unknown. If you will run this, fetch the quiverquant package and this script from trusted sources and verify integrity (checksums / repository). Consider running first in an isolated environment. - Network and data handling: The script will make outbound calls to Quiver's API. If you need to audit traffic, run it in a controlled environment or capture outgoing endpoints to confirm they go to Quiver's official API domains. Given the metadata mismatches (env and dependency), treat this as suspicious rather than benign. If the owner/source can correct the metadata (declare QUIVER_API_KEY and the quiverquant dependency) and provide a trustworthy homepage/repo, the risk assessment would improve.

Type: OpenClaw Skill Name: quiver Version: 1.0.1 The skill bundle is benign. The `SKILL.md` provides clear instructions for using the skill without any prompt injection attempts. The `scripts/query_quiver.py` script legitimately reads the `QUIVER_API_KEY` environment variable to authenticate with the Quiver Quantitative API and queries data as described. There is no evidence of data exfiltration beyond the intended API calls, malicious execution, persistence mechanisms, or obfuscation.