← Back to Skills Marketplace
116
Downloads
0
Stars
0
Active Installs
5
Versions
Install in OpenClaw
/install test-x-sear
Description
Analyze stocks and cryptocurrencies using Yahoo Finance data. Supports portfolio management, watchlists with alerts, dividend analysis, 8-dimension stock sco...
Usage Guidance
This skill appears to be a legitimate stock/crypto analysis bundle, but exercise caution before installing or following the Twitter-related setup steps. Specific recommendations:
- Do NOT follow instructions to grant Terminal 'Full Disk Access' or to copy browser cookies unless you fully trust the developer — copying browser cookies gives broad access to your logged-in accounts. Prefer creating a Twitter/X developer app and using proper API keys with minimal scopes instead of extracting cookies.
- The package asks you to store AUTH_TOKEN and CT0 in a .env file; storing session cookies in plaintext is risky. If you must enable social features, use dedicated API credentials and place them in a secure secret store.
- Verify the Homebrew formula 'uv' before installing (check the tap and upstream project). If unsure, run the Python scripts directly inside an isolated environment (virtualenv/container) rather than installing new system binaries.
- Inspect network behavior: review the scripts for where data is POSTed or external endpoints beyond documented sources. Run the code in a sandbox or VM first and monitor outbound connections.
- If you only need core analysis, skip optional social features (hot_scanner --no-social or --fast) to avoid the parts that request elevated privileges.
If you want higher assurance, ask the publisher for: (1) the official brew tap/source for 'uv', (2) justification for requiring browser cookie extraction vs API tokens, and (3) a minimized set of instructions that don't request elevated OS permissions. If those answers are unsatisfactory, run the tool in an isolated VM/container and avoid supplying browser cookies.
Capability Analysis
Type: OpenClaw Skill
Name: test-x-sear
Version: 1.0.5
The bundle is a comprehensive stock and cryptocurrency analysis tool that aggregates data from Yahoo Finance, CoinGecko, SEC EDGAR, and Google News. It includes features for portfolio management, dividend analysis, and social sentiment tracking via the third-party 'bird' CLI for Twitter/X. While the tool requires sensitive session tokens for Twitter integration and executes local sub-processes to run its own scripts and the bird CLI, all behaviors are transparently documented and strictly aligned with the stated financial analysis purpose, with no evidence of data exfiltration or malicious intent.
Capability Tags
Capability Assessment
Purpose & Capability
The skill name/description and included Python scripts (analysis, hot scanner, watchlist, portfolio, dividends, rumor scanner) are consistent with a stock/crypto analysis tool. Requiring the 'uv' binary is coherent with many CLI examples that use 'uv run', though several commands use 'python3' directly which is inconsistent. The optional Twitter integration is relevant to 'hot scanner' and 'rumor scanner', but the metadata declares no required env vars while the docs instruct collecting Twitter auth cookies — a mismatch.
Instruction Scope
SKILL.md and docs instruct users to obtain Twitter/X auth by copying browser cookies (auth_token and ct0) via DevTools and to grant Terminal 'Full Disk Access' on macOS. Those steps direct collection of sensitive browser tokens and require elevated system permissions that are outside the normal scope of a data-aggregation/analysis skill. The skill also tells you to create a .env with those tokens and to store portfolio/watchlist data under a home path; the cookie-extraction instructions in particular are disproportionate.
Install Mechanism
Install spec uses a Homebrew formula 'uv' which matches the declared required binary 'uv'. Using a brew formula is a low-to-moderate risk install pattern — verify the formula source/tap and checksum before installing. There is no download-from-arbitrary-URL or extract step in the provided install spec. The presence of both 'uv run' and direct 'python3' invocation is inconsistent but not itself malicious.
Credentials
Declared requirements list no env vars, but documentation asks the user to place AUTH_TOKEN and CT0 in a .env (browser cookie values) for Twitter access. That creates a gap between declared and actual credential needs. Additionally, instructions to grant Terminal full-disk access to retrieve cookies are high-privilege and unnecessary if a proper API/key-based Twitter integration is used. Storing auth cookies in plaintext .env files is also risky.
Persistence & Privilege
The skill persists user data to ~/.clawdbot/skills/stock-analysis (portfolios.json, watchlist.json) which is reasonable for a CLI tool. However, the documentation's guidance to grant 'Full Disk Access' to the Terminal (macOS) elevates privilege beyond normal execution needs and could enable access to other apps' data (cookies). While the skill itself is not flagged as always-enabled, the combination of instructions that require elevated OS permission plus cookie extraction increases the potential blast radius.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install test-x-sear - After installation, invoke the skill by name or use
/test-x-sear - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.5
No changes detected in this version.
- Version 1.0.5 does not contain any file changes.
- Functionality, documentation, and features remain unchanged from the previous version.
v1.0.4
No changes detected in this version.
- Version 1.0.4 was released with no file changes.
- Functionality remains the same as the previous version.
v1.0.2
**Major update: Skill renamed and fully repurposed for stock and crypto analysis with new features.**
- Now analyzes stocks and cryptocurrencies using Yahoo Finance data with portfolio tracking, watchlists, dividend analysis, and multi-source viral/rumor scanners.
- Added extensive documentation and sample scripts for portfolio management, trend detection, and rumor analysis.
- Provides CLI commands for stock/crypto analysis, comparisons, alerts, and portfolio actions.
- Removed legacy X (Twitter) search scripts and all related references.
- New architecture and usage docs added for easier onboarding.
v1.0.1
No changes detected in this version.
- There are no file changes compared to the previous version.
- Functionality, usage, and documentation remain the same.
v1.0.0
Initial release of x-search (test-x-sear) skill:
- Search X (Twitter) posts in real time using the xAI Grok API.
- Flexible filtering: filter or exclude up to 10 handles, define date ranges, and target posts with images or video.
- Easy setup via XAI_API_KEY environment variable.
- Search results include post content, author info, and original post citations.
- Full command-line usage documentation included.
Metadata
Frequently Asked Questions
What is testskill-zip1?
Analyze stocks and cryptocurrencies using Yahoo Finance data. Supports portfolio management, watchlists with alerts, dividend analysis, 8-dimension stock sco... It is an AI Agent Skill for Claude Code / OpenClaw, with 116 downloads so far.
How do I install testskill-zip1?
Run "/install test-x-sear" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is testskill-zip1 free?
Yes, testskill-zip1 is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does testskill-zip1 support?
testskill-zip1 is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created testskill-zip1?
It is built and maintained by yuangui (@yinwuzhe); the current version is v1.0.5.
More Skills