trading-agents.skill

Orchestrate a swarm of specialized Claude subagents that simulate a professional trading firm to analyze stocks and produce trading decisions. Based on the T...

This skill appears to do what it says: orchestrate analyst subagents and run supporting Python scripts to fetch market data and compute indicators. Before installing/running: 1) Review and vet the 'uv' package (SKILL.md asks you to pip install it) — it's uncommon and will control the environment; consider using a known tool (venv/virtualenv) instead or inspect the package on PyPI. 2) Inspect pyproject.toml dependencies (akshare, yfinance) and be aware they access external financial data sources; run in an isolated environment or sandbox to limit blast radius. 3) Expect network activity (web searches, site scraping) — if you plan to provide sensitive portfolio context to the skill, be cautious because reports include saved files and links. 4) If you need to comply with scraping/terms-of-service, confirm the data sources and usage. 5) If uncertain, run the scripts manually in a controlled environment first to confirm behavior and outputs.

Type: OpenClaw Skill Name: trading-agents-skill Version: 0.0.2 The skill bundle implements a complex multi-agent trading analysis system that utilizes risky capabilities, including executing shell commands (via 'uv run') and performing extensive web searches. While these actions are aligned with the stated purpose of stock analysis, the instructions in SKILL.md and various agent prompts (e.g., fundamental_analyst.md) direct the AI to construct and run shell commands using user-provided ticker symbols, which presents a potential shell injection vulnerability. Additionally, the skill requires installing and syncing dependencies at runtime ('pip install -U uv' and 'uv sync'), which involves fetching remote artifacts. No evidence of intentional malice or data exfiltration was found, but the high-risk execution model warrants a suspicious classification.