Yahoo Finance (yfinance) powered stock analysis skill: quotes, fundamentals, ASCII trends, high-resolution charts (RSI/MACD/BB/VWAP/ATR), plus optional web a...
Security Analysis
high confidenceThe skill's code, dependencies, and instructions match its stated purpose (yfinance-based quoting, charting, optional DDG news and UnusualWhales scraping); there are no unexplained credential or install demands and no evidence of hidden exfiltration.
Name/description (yfinance charts, quotes, news, options links) align with included files: yf.py implements yfinance charting/indicators, ddg_search.py and news.py provide DuckDuckGo searches, options_links.py prints Unusual Whales URLs, and uw.py implements an optional Playwright scraper. No unrelated credentials, binaries, or config paths are requested.
SKILL.md commands and subcommands map directly to the vendored scripts and their behaviors. The instructions remain within the stated scope (price/fundamentals/history/report/news/options). The only noteworthy expansion is the uw.py scraper which navigates UnusualWhales for optional live flow — this is consistent with the 'browser-first options/flow' description and the SKILL.md explicitly notes browser fallback.
This is instruction-only (no packaged install). Scripts include commented dependency lists and SKILL.md expects use of 'uv run --script' and pip installs (e.g., ddgs). uw.py depends on Playwright, which typically downloads browser binaries on install/runtime; SKILL.md does not automate that. This is not malicious but may surprise users: installing Playwright and other Python packages will pull network resources and write files to disk.
The skill declares no required environment variables or credentials and the code does not attempt to read secrets or external config paths. Network access is used (yfinance, ddgs, Playwright-driven scraping) which is appropriate for a market-data/news/website-scraping tool.
The skill is not always-enabled and does not request elevated platform privileges. It does not modify other skills or agent-wide settings. The only persistence risk is typical for local Python tools (installed packages and Playwright browser binaries), which are limited to the host environment and expected for the provided functionality.
Guidance
This skill appears to do what it says: run local Python scripts that fetch market data, create charts, and optionally search news or scrape UnusualWhales. Before installing or running: 1) Review the included scripts (you already have the source) and run them in an isolated environment (virtualenv or container) if you don't trust the author. 2) Expect to pip-install dependencies (yfinance, ddgs, plot/ML libs) and for Playwright to download browser binaries; these actions require network access and will write files to disk. 3) The UnusualWhales helper scrapes a third-party site — respect that site's terms of use and be aware scraping may fail or require a browser session/cookies. 4) No credentials are required by the skill, so do not provide secrets. If you want higher assurance, run the tooling in a sandbox and monitor outgoing network connections during first use.
Latest Release
v1.2.12
Improve README/positioning copy (toolkit-style).
More by @kys42
Published by @kys42 on ClawHub