← Back to Skills Marketplace
Vnstock Free Expert
by
Nguyễn Đức Thành
· GitHub ↗
· v1.0.2
609
Downloads
0
Stars
2
Active Installs
3
Versions
Install in OpenClaw
/install vnstock-free-expert
Description
Runs an end-to-end vnstock workflow for free-tier-safe Vietnam stock valuation, ranking, and API operations with strict rate-limit control; used when users r...
Usage Guidance
This package appears to implement a legitimate vnstock valuation pipeline, but take the following precautions before installing or running it:
- Inspect the packaged scripts locally (scripts/*.py). They will make network requests and automatically load a .env file for API keys—do not run them with high-privilege or production credentials.
- The registry did not declare required env vars, yet the skill reads VNSTOCK_API_KEY and references other external API keys. Only put a minimally privileged, test-scoped API key in .env, or run without keys to stay in guest limits.
- Manually open SKILL.md in a text editor that shows invisible characters and remove/verify any control/unicode-control characters; they can affect prompt processing.
- Run the code in an isolated environment (container or VM) so any unexpected network activity is contained; monitor outbound connections during first runs.
- If you plan to use connectors (FMP, DNSE, Binance) provide separate scoped keys per connector and verify where each script sends data. Consider grepping scripts for hard-coded endpoints or upload URLs.
- If you are not comfortable reviewing code, prefer a well-known upstream vnstock package from PyPI/GitHub instead of this unknown-source bundled skill.
Confidence in this assessment is medium because the majority of files and instructions are coherent with the claimed purpose, but the missing declared env vars and hidden unicode-control characters create uncertainty that requires manual review.
Capability Analysis
Type: OpenClaw Skill
Name: vnstock-free-expert
Version: 1.0.2
The skill is designed for legitimate financial analysis using the `vnstock` library. However, the `scripts/invoke_vnstock.py` script allows for highly dynamic invocation of arbitrary Python classes and methods with user-controlled arguments. While intended for broad `vnstock` feature coverage, this capability presents a significant Remote Code Execution (RCE) vulnerability if an AI agent were to be prompted to execute malicious class/method combinations and arguments via this script. There is no evidence of intentional malicious behavior within the skill's code or documentation, but the inherent risk of this dynamic execution makes it suspicious.
Capability Assessment
Purpose & Capability
The name/description match the included scripts and documentation: the skill is a vnstock-based valuation/ranking pipeline and the scripts (build_universe, collect_market_data, collect_fundamentals, score_stocks, generate_report, run_pipeline, invoke_vnstock) are consistent with that purpose. Minor mismatch: requires.env in registry lists no required environment variables, but the SKILL.md repeatedly documents and expects a VNSTOCK_API_KEY in a local .env and references many optional external API keys (FMP, DNSE, BINANCE, etc.). This is plausible for the stated purpose but the registry metadata should have declared these env requirements.
Instruction Scope
The SKILL.md gives a bounded, step-by-step workflow and enforces free-tier rate-limiting rules (good). It instructs the agent to read included reference docs and to load an optional .env file (VNSTOCK_API_KEY) and to save/reuse cached artifacts. That .env access is within the task (auth for vnstock) but the docs also list many other external connector API keys and show example commands with absolute local paths—these examples could confuse an agent into looking for user-local paths. The SKILL.md contains hidden unicode-control characters (prompt-injection signal) which may alter how an agent processes the instructions; this is suspicious and should be inspected.
Install Mechanism
There is no install spec (instruction-only), so nothing will be automatically downloaded or written by an install step. That reduces supply-chain risk. However, code files are packaged with the skill (scripts/...), so running those scripts will perform network operations; there is no separate installer that would fetch arbitrary binary artifacts.
Credentials
The registry metadata declares no required env vars, yet the runtime instructions and documentation expect VNSTOCK_API_KEY in a .env and reference many optional external API keys (FMP_API_KEY, DNSE_API_KEY, BINANCE_API_KEY/SECRET, etc.). The scripts are described as auto-loading .env keys. This mismatch is a red flag: the agent (or the included scripts) may read secrets from a local .env that the registry did not surface. Users should not provide broad credentials; keys should be scoped and tested in an isolated environment.
Persistence & Privilege
The skill does not request always:true and does not claim to modify other skills or system-wide settings. It documents creating outputs/outputs/* and caching artifacts within its own project directory, which is normal for a pipeline. Autonomous invocation is allowed (default), which is expected for skills and not flagged alone.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install vnstock-free-expert - After installation, invoke the skill by name or use
/vnstock-free-expert - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.2
vnstock-free-expert 1.0.2
- Minor update to agent configuration (agents/openai.yaml) with no changes to skill logic or documentation.
- No changes to usage, API, scripts, or user-facing behavior.
v1.0.1
- Added a required downstream handoff bundle specification for single-ticker or small-list deep dives, enabling output as a compact JSON for reuse by other skills.
- No changes to workflow, interface, or main script behavior.
- Documentation updated to describe JSON bundle contents and use cases for cross-skill integration.
v1.0.0
- Initial release of vnstock-free-expert for advanced, free-tier-safe Vietnam stock analysis.
- Implements strict rate-limit control and caching to stay within API free-tier constraints.
- Provides a complete end-to-end pipeline: universe building, data collection, scoring, report generation.
- Uses kbs as primary data source, with vci fallback; excludes tcbs; disables Screener API by default.
- Enforces required confidence rubric and clear reporting of coverage, risks, and missing data.
- Includes generic method invocation scripts for broader vnstock package access.
Metadata
Frequently Asked Questions
What is Vnstock Free Expert?
Runs an end-to-end vnstock workflow for free-tier-safe Vietnam stock valuation, ranking, and API operations with strict rate-limit control; used when users r... It is an AI Agent Skill for Claude Code / OpenClaw, with 609 downloads so far.
How do I install Vnstock Free Expert?
Run "/install vnstock-free-expert" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Vnstock Free Expert free?
Yes, Vnstock Free Expert is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Vnstock Free Expert support?
Vnstock Free Expert is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Vnstock Free Expert?
It is built and maintained by Nguyễn Đức Thành (@ndtchan); the current version is v1.0.2.
More Skills