Portfolio Daily Tracker

Track and report multi-group stock portfolios with daily snapshots, live Yahoo Finance prices, P&L analytics, and push notifications (Feishu/Telegram). Suppo...

This skill appears to implement what it claims, but before running setup.sh or otherwise installing it you should: 1) inspect the GitHub repository it clones (https://github.com/Stepuuu/portfolio-daily-tracker.git) — ideally pin to a specific commit or tag instead of cloning the HEAD; 2) review the repo's scripts (portfolio_daily_update, portfolio_manager, snapshot/report scripts) to confirm there is no unexpected network exfiltration or destructive behavior; 3) review dashboard/requirements.txt and avoid installing untrusted packages without vetting; 4) run setup in a restricted environment (non-root account, isolated VM/container) if you want to test; 5) only provide FEISHU/TELEGRAM tokens and an OPENAI key if you trust the code that will transmit notifications; and 6) back up any existing portfolio data before letting the skill modify files. These precautions reduce supply-chain and execution risk. If you want, I can list the files in the upstream GitHub repo or help identify which dependencies to audit/pin.

Type: OpenClaw Skill Name: portfolio-daily-tracker Version: 1.2.0 The skill facilitates portfolio management by instructing the AI agent to execute shell commands with parameters derived from user input (e.g., `<ticker>`, `<qty>`), which creates a high risk of shell injection if the agent or the underlying `portfolio_manager.py` fails to sanitize inputs (SKILL.md). Additionally, `scripts/setup.sh` clones an external repository (github.com/Stepuuu/portfolio-daily-tracker.git) to fetch the 'engine' scripts, introducing a supply chain risk. While the functionality appears aligned with the stated purpose of tracking investments, the combination of shell execution and external code fetching is inherently risky.