Agent Economy ReportAgent Economy ReportCAUTION version 6.2.0 · audited 2026-09-17
The stock-analysis package is a set of Python scripts and documentation for stock and crypto research, portfolio tracking, watchlists, dividend analysis, and trending or rumor scanning. It makes outbound network requests to financial and social data sources, and it can optionally run the third-party “bird” CLI for Twitter/X searches. The optional Twitter feature asks the user to place AUTH_TOKEN and CT0 credentials in a .env file, which the scripts load into their environment and pass to the bird CLI. The scripts write portfolio, watchlist, and scan-cache files under the skill’s own user directories. No hidden destinations, credential exfiltration, download-and-execute, payment redirection, wallet access, or persistence mechanisms were found. The behavior matches the declared purpose, but the optional credential handling and external command execution justify CAUTION.
| Declared purpose | Analyze stocks and cryptocurrencies using Yahoo Finance data; support portfolio management, watchlists with alerts, dividend analysis, 8-dimension stock scoring, viral trend detection, and rumor or early-signal detection. |
| Observed behavior | The scripts fetch data from Yahoo Finance, CoinGecko, Google News, SEC EDGAR, Reddit, and optionally Twitter/X through the bird CLI. They generate BUY/HOLD/SELL scores, dividend metrics, trend summaries, and rumor lists. They read a skill-level .env file if present, run bird as an external subprocess for optional social scans, and write portfolio state plus cache JSON files to the skill’s directories. |
| Verdict, rules only | CAUTION · runs subprocesses or eval/exec |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | Fetches market data from Yahoo Finance, CoinGecko, Google News, SEC EDGAR, and Reddit; optionally fetches Twitter/X data through the bird CLI. |
| shell | needed | Runs the external bird CLI via subprocess for Twitter/X searches in hot_scanner.py and rumor_scanner.py; no shell=True usage was observed. |
| filesystem_read | needed | Reads a .env file for Twitter/X credentials and reads portfolio/watchlist state files from the skill state directory. |
| filesystem_write | needed | Writes portfolio/watchlist state and scan-cache JSON files under the skill’s user directories. |
| credentials | needed | Docs instruct storing Twitter/X AUTH_TOKEN and CT0 in a .env file; scripts load those values into the environment and provide them to bird. |
| install_packages | needed | README instructs optional installation of the bird CLI through npm; SKILL metadata declares uv as a required runtime. |
| severity | finding |
|---|---|
| medium | Instructions to store Twitter/X auth tokens The optional Twitter/X feature requires placing auth_token and ct0 credentials in a skill-directory .env file. A careful user should review this because the scripts read that file. SKILL.md:154 3. Create `.env` with `AUTH_TOKEN` and `CT0` |
| medium | Loads .env values into process environment The hot scanner reads a .env file from the skill root and copies each KEY=VALUE line into os.environ, making credentials or other .env values available to child processes such as bird. scripts/hot_scanner.py:30 os.environ[key] = value |
| low | Executes external bird CLI via subprocess The scanner runs the bird binary with arguments for Twitter search. It uses a list argument form rather than shell=True, but this remains an external command execution capability. scripts/hot_scanner.py:388 result = subprocess.run( |
| low | Executes external bird CLI in rumor scanner The rumor scanner invokes the bird CLI for Twitter rumor queries using an environment copied from the process, including any values loaded from the skill .env file. scripts/rumor_scanner.py:81 result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, env=env) |
| info | Writes portfolio data to disk PortfolioStore writes portfolios.json using an atomic temporary file and rename. The storage path is under the skill state directory. scripts/portfolio.py:116 with open(tmp_path, "w", encoding="utf-8") as f: |
| info | Hot scanner writes cache file Saves hot scan results to cache/hot_scan_latest.json in the skill directory. scripts/hot_scanner.py:533 json.dump(summary, f, indent=2, default=str) |
| info | Rumor scanner writes cache file Saves rumor scan results to cache/rumor_scan_latest.json in the skill directory. scripts/rumor_scanner.py:338 output_file.write_text(json.dumps(output, indent=2, default=str)) |
| info | Optional third-party CLI install The optional Twitter/X integration depends on installing the third-party bird CLI through npm. README.md:145 1. Install bird CLI: `npm install -g @steipete/bird` |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| api.coingecko.com | not in the service index | scripts/hot_scanner.py:106 |
| clawhub.ai | not in the service index | README.md:5 |
| coingecko.com | not in the service index | README.md:183 |
| finance.yahoo.com | not in the service index | README.md:182 |
| github.com | not in the service index | docs/HOT_SCANNER.md:114 |
| img.shields.io | not in the service index | README.md:5 |
| money.cnn.com | not in the service index | README.md:184 |
| news.google.com | not in the service index | README.md:186 |
| old.reddit.com | not in the service index | scripts/hot_scanner.py:286 |
| openclaw.ai | not in the service index | README.md:6 |
| www.sec.gov | not in the service index | README.md:185 |
| x.com | not in the service index | README.md:187 |
| Binaries invoked | bash, npm, python, python3, uv |
| Environment variables read | AAPL, BTC, CLAWDBOT_STATE_DIR, NVDA, QQQ, SPY, SYMBOL, TSLA |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 8 |
| base64 blobs | 0 |
| File writes | 9 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
App-Plan.md | 442 | 98276ba3eb8d9137… |
README.md | 214 | 899b51e927296282… |
SKILL.md | 248 | 6ae566bdf7f099f0… |
TODO.md | 394 | 3e3cc7022797587e… |
_meta.json | 6 | 1c253b180368d529… |
docs/ARCHITECTURE.md | 408 | b2a86717592fd7f7… |
docs/CONCEPT.md | 233 | 3df36f8710cb6e64… |
docs/HOT_SCANNER.md | 288 | 0c42df93f631b30f… |
docs/README.md | 95 | 86c36fdce36c7c9e… |
docs/USAGE.md | 465 | 9cc1aada593ae985… |
scripts/analyze_stock.py | 2532 | 24e05932926903cc… |
scripts/dividends.py | 365 | f7345eda9b5eb164… |
scripts/hot_scanner.py | 582 | 9a0f9d57a2cc919b… |
scripts/portfolio.py | 548 | 2ef732f6c0a0a9bf… |
scripts/rumor_scanner.py | 342 | 315360567ac98f7e… |
scripts/test_stock_analysis.py | 381 | 2fe52876bdc2aa5f… |
scripts/watchlist.py | 336 | 342730d649fb27e3… |
skill-card.md | 61 | 8850685afe835066… |
The package exceeded the reading budget; the AI saw a truncated copy. The deterministic pass covered every text file.
For agents
JSON: https://agenteconomy.report/k/stock-analysis.audit.json · badge: https://agenteconomy.report/k/stock-analysis.audited.svg ·
skill rating: /k/stock-analysis · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).