SEC Finance

Fetch structured financial data and filing metadata from SEC EDGAR and SEC XBRL companyfacts for US-listed companies, especially Chinese issuers. Use when th...

This skill appears coherent and implements exactly what it claims: resolving CIKs and pulling structured XBRL companyfacts from SEC endpoints. Before installing or running: (1) review or run the included script in a safe environment — it makes network requests to data.sec.gov and www.sec.gov; (2) be aware the script intentionally falls back to disabling SSL verification on failure — this can expose you to man-in-the-middle attacks if your network is compromised, so prefer running it where TLS interception is not possible or modify the code to remove the insecure fallback; (3) no secrets are requested by the skill, so there is no direct credential exposure risk from installing; (4) the issuer list is static and may be incomplete — verify CIKs when accuracy is important. If you need stronger assurance, ask the publisher for provenance (homepage/source) or run the code in an isolated environment first.

Type: OpenClaw Skill Name: sec-finance Version: 0.1.0 The skill is designed to fetch financial data from SEC EDGAR/XBRL but contains a significant security vulnerability. Specifically, `scripts/sec_finance.py` includes a function `_fallback_insecure_ctx` that explicitly disables SSL certificate verification and hostname checking. The script is configured to automatically fall back to this insecure mode if a standard secure connection fails, which exposes the agent to Man-in-the-Middle (MITM) attacks. While this behavior is documented in `SKILL.md` as being for 'endpoint compatibility,' it remains a high-risk capability.