Query free financial data APIs — stocks, crypto, macro, SEC filings
Security Analysis
medium confidenceThe skill's declared requirements and runtime instructions match its stated purpose (a CLI wrapper around free financial data sources); nothing requested or instructed is disproportionate, but the npm install step is the main external risk to vet before installing.
Name/description (query free financial data) align with the declared binaries (node + omd) and the SKILL.md usage examples. The omd CLI is the expected tool for this purpose and the SKILL.md documents the data sources the CLI uses.
SKILL.md only instructs the agent to run the omd CLI, configure API keys (env or CLI), and query listed public data sources. It does not instruct reading unrelated files or exfiltrating arbitrary system data.
Install uses an npm package (kind: node, package: open-market-data) that creates the omd binary. npm-based installs are common and coherent here, but they run code from the package registry (moderate trust requirement). There are no in-repo code files to inspect in this skill bundle, so the actual package contents were not analyzed.
SKILL.md documents optional API keys (FRED, CoinGecko, Finnhub, AlphaVantage) and an EDGAR_USER_AGENT; none are declared as required by the registry, which is reasonable. The listed env vars are proportional to a data-aggregator CLI that can use multiple upstream providers.
The skill does not request always:true and does not declare system-wide config modification. disable-model-invocation is false (normal) so autonomous invocation is allowed by platform default — no additional persistence privileges were requested.
Guidance
This skill appears coherent: it wraps a CLI (omd) for public financial APIs and documents optional API keys. However, the install step pulls an npm package — npm packages can execute code during install and are not pre-reviewed here. Before installing, verify the npm package and upstream GitHub repository (SKILL.md points to https://github.com/anotb/open-market-data) for legitimacy and the expected version. Prefer creating/using only the specific API keys you need, and avoid exposing high-privilege credentials. If you need stronger assurance, fetch and inspect the npm package contents (or the upstream repo) before installation or run the install in an isolated environment.
Latest Release
v0.1.0
Initial release — 8 providers, 13 commands, auto-routing with fallback
More by @anotb
Published by @anotb on ClawHub
