openfinclaw-quantitative-research

Pass

Audited by Gen Agent Trust Hub on Jul 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs users to install the @openfinclaw/cli package from the NPM registry using npx. This is the primary component required for the quantitative analysis and backtesting features.
  • [COMMAND_EXECUTION]: The skill operates by executing shell commands via the openfinclaw CLI. The provided integration examples for Node.js, Python, and Bash demonstrate how an agent can automate these tools using child_process.exec and subprocess.run.
  • [CREDENTIALS_SAFE]: The skill encourages secure secret management by advising users to store their API keys in environment variables (OPENFINCLAW_API_KEY) and automatically setting restrictive permissions (chmod 600) on its local configuration file located at ~/.openfinclaw/config.json.
  • [INDIRECT_PROMPT_INJECTION]: The skill interacts with external financial APIs and community-submitted strategy repositories. While this creates a surface where the agent processes untrusted external data to perform tasks like strategy forking and optimization, this is a standard risk for research tools and is mitigated by the skill's specific focus on financial analysis tasks.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 13, 2026, 07:41 AM
Security Audit — agent-trust-hub — openfinclaw-quantitative-research