openfinclaw-quantitative-research
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install the
@openfinclaw/clipackage from the NPM registry usingnpx. This is the primary component required for the quantitative analysis and backtesting features. - [COMMAND_EXECUTION]: The skill operates by executing shell commands via the
openfinclawCLI. The provided integration examples for Node.js, Python, and Bash demonstrate how an agent can automate these tools usingchild_process.execandsubprocess.run. - [CREDENTIALS_SAFE]: The skill encourages secure secret management by advising users to store their API keys in environment variables (
OPENFINCLAW_API_KEY) and automatically setting restrictive permissions (chmod 600) on its local configuration file located at~/.openfinclaw/config.json. - [INDIRECT_PROMPT_INJECTION]: The skill interacts with external financial APIs and community-submitted strategy repositories. While this creates a surface where the agent processes untrusted external data to perform tasks like strategy forking and optimization, this is a standard risk for research tools and is mitigated by the skill's specific focus on financial analysis tasks.
Audit Metadata