Is buxibuxi/stock-copilot-pro safe?
Yes. buxibuxi/stock-copilot-pro is safe to install. Oathe's behavioral security audit gave the stock-copilot-pro skill by buxibuxi a trust score of 94/100 with 3 findings, none critical or high.
https://clawhub.ai/buxibuxi/stock-copilot-pro
Is buxibuxi/stock-copilot-pro safe to install?
This appears to be a legitimate stock analysis skill that provides comprehensive financial analysis using the QVeris API. While it contains extensive JavaScript code that requires careful review, no malicious behavior was detected during installation or in the static analysis.
What security issues were found in buxibuxi/stock-copilot-pro?
Category Scores
Findings (3)
MEDIUM Extensive JavaScript Codebase -5 ▶
The skill contains a large amount of JavaScript code (40+ files) which could potentially hide malicious functionality within legitimate-looking code. While no obvious malicious patterns were detected, the complexity makes comprehensive analysis challenging.
LOW Credential File Access During Installation -10 ▶
System processes accessed sensitive credential files (.env, SSH keys, AWS credentials) during the installation session. However, this appears to be related to SSH authentication rather than the skill itself accessing these files.
INFO Legitimate API Usage Declaration 0 ▶
The skill properly declares its network requirements and limits outbound connections to qveris.ai, which is appropriate for its stock analysis functionality. The skill metadata and documentation are comprehensive and consistent.
Should I install buxibuxi/stock-copilot-pro?
Oathe's verdict for buxibuxi/stock-copilot-pro is SAFE with a trust score of 94/100. Recommendation: Install.