US Stock Financials

Fetch comprehensive financial data from SEC EDGAR XBRL for US-listed companies (especially Chinese ADRs). Includes balance sheet, income statement, cash flow...

This skill appears to do what it claims, but review a few things before running: 1) Inspect the full scripts (the provided listing was truncated) to confirm there is no hidden network exfiltration or unexpected behavior. 2) The code contains an explicit insecure SSL fallback that disables certificate verification; consider removing that fallback or restricting it to debugging only, because it makes network requests susceptible to MITM. 3) Do not run the 'pip3 install ... --break-system-packages' command on a system Python; instead create and use a virtualenv (python3 -m venv .venv && source .venv/bin/activate && pip install reportlab). 4) Run the script in an isolated environment (container/VM) if you are unsure, and avoid providing any unrelated credentials to the process. 5) If you plan to make many requests to SEC endpoints, consider adding a contact email per SEC access guidance and rate-limiting your requests to avoid being blocked.

Type: OpenClaw Skill Name: us-stock-financials Version: 1.0.0 The skill bundle provides legitimate financial data retrieval from SEC EDGAR but contains a security vulnerability in `scripts/sec_finance.py`, which implements a fallback mechanism that disables SSL certificate verification (`ssl.CERT_NONE`), exposing the agent to man-in-the-middle (MITM) attacks. Additionally, `SKILL.md` includes instructions to install dependencies using the `--break-system-packages` flag, which can compromise the integrity of the host's system-managed Python environment.