Yahoo Claw

Yahoo Finance API integration for OpenClaw. Use when users ask for stock prices, company financials, historical data, dividends, or market data. Supports rea...

This skill largely appears to do what it claims (use yahoo-finance2, optionally fallback to Alpha Vantage). Before installing: 1) Review SKILL.md and README for hidden control characters (the pre-scan flagged unicode-control-chars). 2) Confirm whether DATABASE_PATH/SQLite is actually required — the code shipped uses in-memory caching; if you don't want disk access, verify no SQLite or file-write code exists in the omitted files. 3) If you provide ALPHA_VANTAGE_API_KEY, store it securely (environment variable or secrets store); the key is optional and only used as a backup. 4) Run npm install and run the skill in a sandboxed environment first, monitor outbound domains (expected: Yahoo Finance endpoints and alphavantage.co), and inspect network traffic. 5) If you need higher assurance, ask the author or request a minimal reproducible build that shows whether any filesystem or external endpoints beyond finance APIs are contacted. If you are uncomfortable with the documentation inconsistencies or the unicode-control-chars finding, treat the package as untrusted until clarified.

Type: OpenClaw Skill Name: yahooclaw Version: 0.1.7 The yahooclaw skill bundle provides comprehensive financial data integration for OpenClaw, including real-time quotes and technical analysis. However, it is classified as suspicious due to a hardcoded Alpha Vantage API key ('9Z6PTPL7AB5M5DN3') found in 'test-alpha.js', which constitutes a credential exposure vulnerability. While the core logic in the 'src/' directory appears to align with the stated purpose and uses environment variables for production configuration, the inclusion of hardcoded secrets in test files is a high-risk practice.