ClawAudit verdict
A股-股市分析和投资顾问（安西军项目）
a-stocks-analysis
The skill accesses credentialed stock data, which could be risky if credentials are not properly handled, but it seems to follow best practices for credential use.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. ClawAudit flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Why the tier is capped
Execution sink present in raw bytes (Hard Floor: class B). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.
Permissions & capabilities
Requires 1 environment variable. (1 sensitive: TAX_API_KEY).
credential_access Is this flag fair?
Thanks — recorded.