Is keyfrog-21k/openclaw-finnhub safe?
https://github.com/openclaw/skills/tree/main/skills/keyfrog-21k/openclaw-finnhub
This skill appears to be a legitimate stock quote fetcher using the Finnhub API with straightforward functionality. While some sensitive files were accessed during monitoring, canary integrity was maintained suggesting system-level rather than malicious access.
Category Scores
Findings (4)
MEDIUM Sensitive File System Access -15 ▶
Multiple sensitive credential files were accessed during the monitoring period including .env, SSH keys, AWS credentials, Docker config, and GCloud credentials. However, canary file integrity was maintained suggesting these accesses were from system processes rather than malicious skill behavior.
LOW Code Quality Issue -5 ▶
The Python script contains a bug where it passes a list [sys.argv[2]] instead of a string sys.argv[2] to the get_quote function, which could cause runtime errors when calling the Finnhub API.
LOW Honeypot File Access -5 ▶
Canary files were accessed but not modified or exfiltrated, indicating the access was likely from system processes rather than malicious skill behavior.
LOW Implementation Quality -10 ▶
The skill has minor implementation issues but appears to function as documented for fetching stock quotes from the Finnhub API.