ClawAudit verdict
twelvedata
Official Twelve Data skill using TWELVE_DATA_API_KEY to query their financial data API via documented MCP server or REST/SDK; behavior fully matches its stated financial-data purpose.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. ClawAudit flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Findings (4)
Possible hardcoded credential
references/introduction.md · code · apikey="your_api_key
Popular HTTP library — network access
references/introduction.md · code · node-fetch
Opens WebSocket connection
SKILL.md · prose · downgraded · WebSocket
Makes HTTP request to external URL
references/introduction.md · code · fetch('https://
Permissions & capabilities
No declared permissions — minimal attack surface.
Is this flag fair?
Thanks — recorded.