super-stock-analysis

Analyze stocks and cryptocurrencies using Yahoo Finance data. Supports portfolio management, watchlists with alerts, dividend analysis, 8-dimension stock sco...

This skill appears to implement the features it promises, but proceed cautiously. Specific things to consider before installing or running: - Do not follow the README instruction to copy browser cookies (AUTH_TOKEN/CT0) into a .env file unless you fully trust the source—copying session cookies is sensitive and can expose your account. Prefer official OAuth or API keys from the platform. - Verify the Homebrew 'uv' formula origin before installing. If possible, run the Python scripts with a controlled Python environment (venv) instead of installing unknown system packages. - The README and code disagree on storage locations (~/.marketpulse vs ~/.clawdbot); review and set a safe storage path and back up existing files before running scripts that persist local data. - The repository includes a batch_refactor.py that will modify Python files when executed; do not run it unless you audit and trust the modifications. Treat it as a code-changing tool rather than a benign helper. - Additional runtime dependencies (node bird CLI, Twitter auth, third-party Python libraries) are referenced in docs but not declared in metadata—inspect and install dependencies in a sandbox first (or run in an isolated VM/container). If you want to proceed, run the code in an isolated environment, review the scripts you plan to use (especially trend_scanner/signal_scanner/watchlist_manager), and avoid pasting any secrets or copying session cookies into files. If you can provide the brew formula URL for 'uv' and clarify whether any agent will be allowed to execute these scripts autonomously, I can update the assessment and raise/clear specific concerns.

Type: OpenClaw Skill Name: super-stock-analysis Version: 1.0.0 The skill bundle is a comprehensive market analysis tool, but it is classified as suspicious due to several high-risk indicators. Most notably, the SKILL.md file contains a nonsensical, bracketed string of text that resembles a prompt injection attempt or a hidden trigger for AI models. Additionally, scripts/batch_refactor.py is designed to programmatically modify other Python files within the bundle, which is a risky capability. The scripts/trend_scanner.py and scripts/rumor_scanner.py files also use subprocess to execute an external binary ('bird') from a hardcoded path in a specific user directory (/home/clawdbot/), indicating a potential for unauthorized execution if the environment is not strictly controlled.