Stock Analysis

Analyze stocks and cryptocurrencies using Yahoo Finance data. Supports portfolio management, watchlists with alerts, dividend analysis, 8-dimension stock sco...

This skill largely implements what it claims (stock/crypto analysis, hot scanner, watchlists), but there are red flags you should consider before installing: - Do not grant Full Disk Access or copy browser cookies just to enable Twitter features. Instead, prefer creating API credentials via official developer access if you need social data; copying cookies is risky and can expose other accounts. - Inspect the 'uv' brew formula before installing. Confirm it is the tool you expect (or run the Python scripts directly with python3 in a controlled environment). - The repository references optional notification integrations (Feishu, Telegram, etc.) but does not declare required env vars — check each script for where it expects tokens and where it would send data (webhook URLs). Avoid putting secrets in plaintext .env files in your home directory. - Run the code in an isolated environment (VM or container) and audit outgoing network calls before giving it persistent access or cron jobs. Monitor what endpoints the scripts contact and ensure they are legitimate (Yahoo, CoinGecko, Google News, SEC, approved APIs). - If you only need basic analysis, run scripts without optional integrations (use --no-social / --fast flags) to avoid the parts that require extra credentials. If you want, I can: (1) show the specific files that attempt to read environment variables or cookies, (2) help inspect the brew formula for 'uv', or (3) produce a short checklist to harden running this skill (containerization, least-privilege, secrets handling).

Type: OpenClaw Skill Name: nidhov01-stock-analysis Version: 1.0.0 The skill bundle contains hardcoded Feishu (Lark) recipient IDs (e.g., 'ou_f1a29f8d231d21d113acbea658fc45fe') in scripts/daily_review_auto.py and scripts/send_feishu_review.py, which would direct the user's private portfolio data and market reports to a specific external account. While likely a developer oversight from a personal automation setup, this poses a significant data exfiltration risk. Furthermore, the skill requires users to store sensitive Twitter session tokens (AUTH_TOKEN, CT0) in a .env file and uses subprocess.run to execute the 'bird' CLI in scripts/hot_scanner.py and scripts/rumor_scanner.py, which are high-risk behaviors for a generic skill bundle.