yahoo-finance-bist

Yahoo Finance API tabanlı tarihsel veri analizi, algoritmik teknik indikatör skoru (RSI, MACD, Stoch, SMA), Excel geçmiş veri dışa aktarma, portföy alarm tak...

What to consider before installing: - The code provided implements the advertised Yahoo Finance features and does not request credentials, but SKILL.md forces the agent to run local scripts and only return their output (no model reasoning shown). That pattern is unusual because it makes the agent a blind conduit for script outputs — verify you trust the included scripts. - Review the included Python files yourself (they are bundled) and confirm they do only what you expect: fetch Yahoo endpoints, compute indicators, and write CSV/HTML in the skill folder. They do not contact other external domains or read arbitrary system files. - Confirm the exec paths in SKILL.md (/home/node/.openclaw/skills/yahoo_portfoy_analiz/...) match where the skill will be installed. If not, the agent may fail to run or attempt to execute different code. - Because scripts write files and can create many CSVs, run the skill in a sandboxed environment or with limited filesystem/network permissions if possible. - If you plan to allow autonomous agents to use this skill, consider disabling autonomous invocation or requiring explicit user confirmation before running any scripts, so the agent cannot silently execute code on keyword matches. - If you need higher assurance, ask the publisher for a signed release or run the scripts manually in a controlled environment to validate outputs before allowing automatic execution.

Type: OpenClaw Skill Name: yahoo-finance-bist Version: 1.0.0 The skill bundle is classified as suspicious due to two significant vulnerabilities. The `investing_excel_exporter.py` script is vulnerable to path traversal, allowing an attacker to write CSV files to arbitrary locations on the filesystem by crafting the `symbol` argument. Additionally, the `investing_trade_logger.py` script is vulnerable to Stored Cross-Site Scripting (XSS) in its generated HTML report (`Nikos_Portfoy_Analiz.html`), as user-controlled `symbol` and `name` values are embedded directly into JavaScript arrays and HTML without proper escaping. While the `SKILL.md` uses prompt injection techniques to control the AI agent's behavior, its intent appears to be to enforce factual data reporting rather than malicious action. All network calls are legitimately directed to Yahoo Finance API.