Is keyfrog-21k/openclaw-finnhub safe?
Yes. keyfrog-21k/openclaw-finnhub is safe to install. Oathe's behavioral security audit gave the openclaw-finnhub skill by keyfrog-21k a trust score of 94/100 with 4 findings, none critical or high.
https://github.com/openclaw/skills/tree/main/skills/keyfrog-21k/openclaw-finnhub
Is keyfrog-21k/openclaw-finnhub safe to install?
This skill appears to be a legitimate stock quote fetcher using the Finnhub API with straightforward functionality. While some sensitive files were accessed during monitoring, canary integrity was maintained suggesting system-level rather than malicious access.
What security issues were found in keyfrog-21k/openclaw-finnhub?
Category Scores
Findings (4)
MEDIUM Sensitive File System Access -15 ▶
Multiple sensitive credential files were accessed during the monitoring period including .env, SSH keys, AWS credentials, Docker config, and GCloud credentials. However, canary file integrity was maintained suggesting these accesses were from system processes rather than malicious skill behavior.
LOW Code Quality Issue -5 ▶
The Python script contains a bug where it passes a list [sys.argv[2]] instead of a string sys.argv[2] to the get_quote function, which could cause runtime errors when calling the Finnhub API.
LOW Honeypot File Access -5 ▶
Canary files were accessed but not modified or exfiltrated, indicating the access was likely from system processes rather than malicious skill behavior.
LOW Implementation Quality -10 ▶
The skill has minor implementation issues but appears to function as documented for fetching stock quotes from the Finnhub API.
Should I install keyfrog-21k/openclaw-finnhub?
Oathe's verdict for keyfrog-21k/openclaw-finnhub is SAFE with a trust score of 94/100. Recommendation: Install with caution.