earnings-calendar

SAFE max severity MEDIUMSkillSpector Do not install 100 registry clawhub.ai last scanned 1 scan

Verdict safe, but 2 findings (1 medium, 1 low), mainly data exfiltration, resource abuse. Most recent scan 2026-02-06.

The earnings-calendar skill is a legitimate financial data retrieval tool with a clear, focused purpose. The skill uses the Financial Modeling Prep API to fetch upcoming earnings announcements for mid-cap and above US stocks. The code is well-structured, transparent, and does not contain malicious functionality such as data exfiltration, command injection, or prompt injection attempts. The primary security concern is the handling of API keys in web environments where users must provide credentials interactively, creating potential exposure risks. The skill also lacks some optional metadata fields and could benefit from improved rate limiting. Overall, this skill poses LOW to MEDIUM risk and is suitable for use with minor improvements to credential handling practices.

Scanner's overall assessment (LLM analyzer)
Findings2
Critical0
High0
Medium1
Low1
Analyzersstatic behavioral llm trigger meta

Second scanner: NVIDIA SkillSpector

VerdictDo not install 100
Score100 / 100
Issues7
CategoriesData Flow System Prompt Leakage Tool Misuse
Version2.12.0 (static)

The two scanners disagree: Cisco found nothing and SkillSpector says do not install. One of them has a blind spot here; read the skill before trusting either. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

This skill retrieves upcoming earnings announcements for US stocks using the Financial Modeling Prep (FMP) API. Use this when the user requests earnings calendar data, wants to know which companies are reporting earnings in the upcoming week, or needs a weekly earnings review. The skill focuses on mid-cap and above companies (over $2B market cap) that have significant market impact, organizing the data by date and timing in a clean markdown table format. Supports multiple environments (CLI, Desktop, Web) with flexible API key management.

Package
6 files, 92 KB
SKILL.md
3218 words, 12+ sections
Code
Python (2)

SKILL.md covers: Earnings Calendar · Overview · Prerequisites · FMP API Key · Core Workflow · Step 1: Get Current Date and Calculate Target Week · Step 2: Load FMP API Guide · Step 3: API Key Detection and Configuration · Step 4: Retrieve Earnings Data via FMP API · Step 5: Process and Organize Data · Step 6: Generate Markdown Report · Upcoming Earnings Calendar - Week of [START_DATE] to [END_DATE]

Findings

MEDIUM API Key Exposure Risk via User Prompt in Web Environment Data Exfiltrationllm

The skill prompts users to enter their FMP API key directly during execution in web environments where no environment variable is available. This creates a risk of API key exposure through chat logs, session storage, or inadvertent sharing. While the skill states the key is 'stored only for current session', there is no evidence of secure handling, encryption, or automatic cleanup of the API key after use.

SKILL.md

#### 3.2 Prompt User for [API Key] (Web Environment)

If environment variable is not set, prompt user to provide API key interactively. The skill documentation states 'API key will be requested during skill execution (stored only for current session)' but does not specify secure handling mechanisms.
Remediation: 1. Add explicit warnings about API key security when prompting users 2. Implement secure credential handling with automatic cleanup 3. Recommend environment variable setup over interactive entry 4. Consider using secure credential storage mechanisms 5. Add documentation about API key rotation best practices
LOW Unbounded API Request Without Rate Limiting Resource Abusellm

The Python scripts make external API requests to Financial Modeling Prep without implementing client-side rate limiting or retry backoff mechanisms. While the FMP free tier has a 250 calls/day limit, the scripts do not implement protective measures against accidental rate limit exhaustion or handle rate limit errors gracefully. This could lead to service disruption if the skill is used repeatedly in a short time period.

scripts/fetch_earnings_fmp.py

The fetch_earnings_calendar method makes direct requests.get() calls without rate limiting:

```python
response = requests.get(url, timeout=30)
if response.status_code != 200:
    print(f"ERROR: FMP API request failed: {response.status_code}", file=sys.stderr)
    return None
```

No retry logic, exponential backoff, or rate limit handling is implemented.
Remediation: 1. Implement client-side rate limiting to prevent API exhaustion 2. Add exponential backoff for failed requests 3. Handle HTTP 429 (Too Many Requests) responses gracefully 4. Add request caching to reduce redundant API calls 5. Document rate limit considerations in user-facing documentation

What is in the package

FileKindSize
SKILL.mddoc22 KB
earnings_calendar_2025-11-02.mddoc24 KB
assets/earnings_report_template.mddoc3.5 KB
references/fmp_api_guide.mddoc16 KB
scripts/fetch_earnings_fmp.pyscript14 KB
scripts/generate_report.pyscript11 KB

External hosts referenced

site.financialmodelingprep.com financialmodelingprep.com finance.yahoo.com seekingalpha.com finviz.com www.marketwatch.com

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

FMP_API_KEY API_KEY YOUR_API_KEY

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills