Stock Analysis 6

Analyze stocks and cryptocurrencies using Yahoo Finance data. Supports portfolio management, watchlists with alerts, dividend analysis, 8-dimension stock scoring, viral trend detection (Hot Scanner), and rumor/early signal detection. Use for stock analysis, portfolio tracking, earnings reactions, crypto monitoring, trending stocks, or finding rumors before they hit mainstream.

Proceed cautiously. Specific things to consider before installing or running: - Source trust: the skill's source is unknown. Only install if you trust the author. - Incomplete metadata: the manifest only declares 'uv', but docs instruct use of python3, bird (Twitter CLI via npm or brew), and browser cookie extraction — expect to manually install Python packages and CLIs. - Do NOT follow the advice to grant Terminal 'Full Disk Access' or copy browser cookie tokens (AUTH_TOKEN / CT0) into a .env unless you fully understand the risks. Extracting cookies and storing them in plaintext is a privacy/security hazard and can expose your account. - Prefer official APIs and scoped API keys. If you want Twitter/X integration, use OAuth tokens or an official API key with least privilege rather than copying browser cookies. - Run first in an isolated environment (VM/container) and inspect the Python scripts (they are included) to see which endpoints they call and whether they log or transmit sensitive data. Look for outgoing network calls and where results are posted or stored. - If you will run the hot_scanner/rumor_scanner on a schedule, restrict network access or run with a dedicated low-privilege account; consider rate limits (SEC EDGAR) and third-party terms of service. - If you need only basic stock analysis, avoid enabling optional social/Twitter features and run with --no-social or --no-insider flags to reduce external requests. What would change this assessment: if the publisher provided an authoritative source URL, a full install script that safely installs Python deps and documents required credentials, and removed instructions that recommend extracting browser cookies, confidence could shift toward 'benign'.

Type: OpenClaw Skill Name: stock-analysis-6 Version: 1.0.0 The skill is classified as suspicious due to critical vulnerabilities. The `scripts/watchlist.py` file contains a shell injection vulnerability where user-controlled `ticker` input from the watchlist is passed unsanitized to `subprocess.run` when checking alerts, allowing arbitrary command execution. Additionally, `scripts/hot_scanner.py` and `scripts/rumor_scanner.py` execute an external `bird` CLI via `subprocess.run` and pass sensitive Twitter authentication tokens (`AUTH_TOKEN`, `CT0`) as environment variables, posing supply chain and data exfiltration risks if the `bird` binary is compromised.