Rally

Research, score, and plan long-only portfolio allocations and trades for public markets with risk constraints and explainable decisions.

This skill looks coherent for portfolio research and constrained allocation planning, but take these precautions before installing or enabling: 1) Inspect the GitHub repository referenced by the skill (https://github.com/indigokarasu/rally) so you know exactly what the self-update will fetch. 2) Keep config.execution.enabled = false until you review broker integrations and confirm any broker credentials are only provided to explicit, audited integration steps. 3) If you do not want automated runs or auto-updates, disable cron registration / rally.update or run them manually. 4) Only provide QUIVERQUANT_API_KEY if you want the congressional_flow signal; it is optional. 5) Verify that writing to ~/openclaw/data/ocas-rally/ and ~/openclaw/journals/ocas-rally/ matches your storage/permission policies and back up any sensitive files. If you want higher assurance, ask the publisher for a signed release tarball or review the repo history and install steps before enabling self-update or scheduling.

Type: OpenClaw Skill Name: ocas-rally Version: 3.0.1 The skill provides a comprehensive framework for financial portfolio management, including universe screening and trade planning. It is classified as suspicious due to high-risk capabilities documented in SKILL.md, specifically a self-update mechanism (rally.update) that uses shell commands to download, extract, and overwrite its own code from a remote GitHub repository (github.com/indigokarasu/rally). Additionally, it automatically registers persistence via cron jobs (rally:daily and rally:update). While these features are aligned with the stated purpose of a self-maintaining autonomous agent, they represent significant attack surfaces for remote code execution and supply chain compromise.