yf-stats

Fetches stock data and generates price charts.

This skill appears to be what it says: it uses yfinance to fetch public market data and matplotlib to save a PNG chart. Before installing, be aware that: 1) installing requirements will pull packages from PyPI (check package versions/trust); 2) the script performs network calls to Yahoo Finance (ensure network policy/sandboxing is acceptable); 3) it writes chart files to the current working directory; and 4) no credentials are required or requested. If you want extra caution, run it in an isolated environment or inspect/ pin the package versions before installing.

Type: OpenClaw Skill Name: yf-stats Version: 1.0.0 The skill contains a potential shell command injection vulnerability in SKILL.md, where the {{ticker}} parameter is substituted into a command string without quoting or sanitization. Additionally, yf_scraper.py is vulnerable to a minor path traversal flaw because it uses the unsanitized ticker input to construct the output filename for generated charts (plt.savefig). While these appear to be unintentional security flaws rather than intentional malware, they represent high-risk vulnerabilities that could be exploited to execute arbitrary commands or write files to unintended locations.