by 安全扫描
OpenClaw
安全
high confidenceThe skill's code and instructions match its stated purpose (fetching Yahoo Finance quotes), request no credentials, and contain no obvious exfiltration or unrelated behavior.
评估建议
This skill is small and does what it says: it issues an HTTPS GET to Yahoo Finance and returns normalized quote data. There are no requested secrets and no install-time downloads, so risk is low. Things to check before installing: ensure your environment has a compatible Node runtime (SKILL.md lists 'node' as required), confirm your organization's policy allows outbound requests to query1.finance.yahoo.com, and note the minor metadata mismatch (registry says no required binaries while SKILL.md r...详细分析 ▾
ℹ 用途与能力
The skill claims to fetch Yahoo Finance quotes and the included index.js does exactly that against https://query1.finance.yahoo.com/v7/finance/quote. Minor metadata inconsistency: SKILL.md declares a runtime dependency on 'node' (metadata.moltbot.requires.bins) and includes a homepage URL, but the registry metadata above lists no required binaries and no homepage. This is likely benign but worth noting.
✓ 指令范围
SKILL.md instructions are narrowly scoped to accepting symbols and returning normalized quote JSON. They do not ask the agent to read arbitrary files, environment variables, or forward data to third-party endpoints beyond Yahoo Finance.
✓ 安装机制
There is no install spec (instruction-only / bundled script), so nothing is downloaded or extracted at install time. The included index.js is small (~2.4 KB) and performs a single HTTPS request to Yahoo; no additional packages or external installers are pulled.
✓ 凭证需求
The skill requires no environment variables, no credentials, and no config paths. That is proportionate to its purpose of fetching public market data.
✓ 持久化与权限
The skill does not request always:true and does not modify other skills or system configs. It can be invoked autonomously by the agent (disable-model-invocation is false) which is the platform default and expected for this type of skill.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.22026/1/29
- Renamed skill from "stock-quote" to "yahoo-data-fetcher". - Replaced implementation file (`stock-quote.js` removed; `index.js` and `package.json` added). - Updated documentation for improved clarity and normalized JSON output. - Enhanced input flexibility with expanded examples. - Unified command and output details for easier use.
● 无害
安装命令
点击复制官方npx clawhub@latest install yahoo-data-fetcher
镜像加速npx clawhub@latest install yahoo-data-fetcher --registry https://cn.longxiaskill.com
技能文档
Get current stock price data from Yahoo Finance.
This skill fetches the latest market quote for one or more stock symbols and returns normalized JSON output.
Command
/stock quote
Fetch the latest quote for one or more stock symbols.
Input
symbols(string or array of strings)
Examples:
"AAPL""AAPL MSFT TSLA""AAPL,MSFT,TSLA"["AAPL", "MSFT"]{ "symbols": ["AAPL", "MSFT"] }
Output
For each symbol:
symbol– stock tickerprice– latest market pricechange– absolute price changechangePercent– percentage changecurrency– trading currencymarketState– market status (e.g.REGULAR,CLOSED)
Example output:
```json [ { "symbol": "AAPL", "price": 189.12, "change": 1.23, "changePercent": 0.65, "currency": "USD", "marketState": "REGULAR" } ]