stock-monitor
Warn
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The documentation in
SKILL.mdinstructs the user to set up a recurring task using theopenclaw croncommand. This creates a persistence mechanism that executes the monitoring scripts every 5 minutes to report price alerts back to the agent. - [EXTERNAL_DOWNLOADS]: The scripts
stocks_monitor.py,futu_stocks_monitor.py, andstocks_rebalance_monitor.pyperform network requests to retrieve market data from Yahoo Finance and Futu OpenD endpoints. These operations are used for fetching real-time price information and do not download executable code. - [CREDENTIALS_UNSAFE]: The
futu_stocks_monitor.pyscript is designed to read anunlock_passwordfrom a local JSON configuration file (futu_stocks_config.json). This facilitates the management of sensitive authentication data required to unlock the Futu trading API for market snapshots. - [PROMPT_INJECTION]: The skill processes data from external financial APIs, which represents a surface for indirect prompt injection if the API content were maliciously manipulated.
- Ingestion points: Market data is ingested via
urllib.requestinstocks_monitor.pyand thefutuSDK infutu_stocks_monitor.py. - Boundary markers: No specific delimiters or safety warnings are included in the script outputs processed by the agent.
- Capability inventory: The skill generates text alerts; it does not involve subprocess execution or dynamic code evaluation based on the retrieved data.
- Sanitization: Scripts utilize JSON parsing and explicitly cast price values to floats, which provides sanitization for the primary data fields.
Audit Metadata