open-market-data

Query free financial data APIs — stocks, crypto, macro, SEC filings

This skill appears coherent: it wraps a CLI (omd) for public financial APIs and documents optional API keys. However, the install step pulls an npm package — npm packages can execute code during install and are not pre-reviewed here. Before installing, verify the npm package and upstream GitHub repository (SKILL.md points to https://github.com/anotb/open-market-data) for legitimacy and the expected version. Prefer creating/using only the specific API keys you need, and avoid exposing high-privilege credentials. If you need stronger assurance, fetch and inspect the npm package contents (or the upstream repo) before installation or run the install in an isolated environment.

Type: OpenClaw Skill Name: open-market-data Version: 0.1.0 The skill is classified as suspicious due to its reliance on installing an external `node` package (`open-market-data`) via `npm`, which introduces a supply chain vulnerability as `npm` packages can execute arbitrary code during installation. Additionally, the skill explicitly handles sensitive API keys for various financial services, which, while necessary for its stated purpose, represents a high-risk capability if the underlying `omd` tool (not provided for analysis) were compromised or malicious. No direct prompt injection attempts or explicit malicious instructions are found in the `SKILL.md` itself.