Yfinance

Fetch live and historical stock data from Yahoo Finance, optimised for Indonesia (IDX) stocks. Use this skill when the user asks about stock prices, historic...

This skill is coherent with its stated purpose, but consider the following before installing or exposing it: - Network exposure: The server defaults to binding 0.0.0.0 and the app sets CORS allow_origins=["*"]. If you run this on a machine reachable from the internet, requests from any origin can reach it. Run behind a firewall or bind to localhost (127.0.0.1) when used only by your agent, or add authentication if you intend public access. - Isolation: Install Python packages in a virtualenv or container rather than system Python to limit impact of package installation. - Review and test: There are minor bugs/typos visible in the provided source (truncated excerpt and a likely ticker.u typo in the dividends endpoint) — review or run unit tests locally before relying on it in production. - Dependencies: The install relies on PyPI packages (yfinance, fastapi, uvicorn, pandas). Verify you trust these package sources and keep them up to date. - If you plan to publish this connector publicly or open port 8000 on a cloud VM, add API access controls and reduce CORS scope to trusted origins. If you want, I can point out the exact lines to change to bind to localhost, remove permissive CORS, or fix the apparent typo so the service runs more safely and reliably.

Type: OpenClaw Skill Name: yfinance Version: 1.0.4 The skill bundle is a legitimate stock market data tool that wraps the yfinance library in a FastAPI server. It provides endpoints for real-time prices, historical data, and company fundamentals, with specific optimizations for Indonesian (IDX) stocks. The code in main.py and the instructions in SKILL.md are consistent with the stated purpose, and no indicators of data exfiltration, malicious execution, or harmful prompt injection were found.