Is keyfrog-21k/openclaw-finnhub safe?

https://github.com/openclaw/skills/tree/main/skills/keyfrog-21k/openclaw-finnhub

94
SAFE

This skill appears to be a legitimate stock quote fetcher using the Finnhub API with straightforward functionality. While some sensitive files were accessed during monitoring, canary integrity was maintained suggesting system-level rather than malicious access.

Category Scores

Prompt Injection 100/100 · 30%
Data Exfiltration 85/100 · 25%
Code Execution 95/100 · 20%
Clone Behavior 100/100 · 10%
Canary Integrity 95/100 · 10%
Behavioral Reasoning 90/100 · 5%

Findings (4)

MEDIUM Sensitive File System Access -15

Multiple sensitive credential files were accessed during the monitoring period including .env, SSH keys, AWS credentials, Docker config, and GCloud credentials. However, canary file integrity was maintained suggesting these accesses were from system processes rather than malicious skill behavior.

LOW Code Quality Issue -5

The Python script contains a bug where it passes a list [sys.argv[2]] instead of a string sys.argv[2] to the get_quote function, which could cause runtime errors when calling the Finnhub API.

LOW Honeypot File Access -5

Canary files were accessed but not modified or exfiltrated, indicating the access was likely from system processes rather than malicious skill behavior.

LOW Implementation Quality -10

The skill has minor implementation issues but appears to function as documented for fetching stock quotes from the Finnhub API.