Community code plugin. Review compatibility and verification before install.
Latest release: v1.0.0Download zip
Capabilities
Compatibility
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The artifacts coherently describe a trend-forecasting skill that combines prediction markets, Twitter/X, news, and financial data through AIsa APIs; the inspected Python code matches that purpose and does not show posting, trading, destructive actions, or unrelated behavior.
Instruction Scope
The metadata uses broad invocation language including Twitter/X monitoring, posting, and engagement workflows, while the implemented runtime is analysis/search-oriented; this may cause over-invocation for social-media tasks but no posting endpoint or mutation path was found.
Install Mechanism
The package is a native OpenClaw plugin wrapper with a bundled skill and Claude-compatible fallback; manifests consistently declare python3, AISA_API_KEY, and network access to https://api.aisa.one.
Credentials
The environment access is proportionate for a cloud API skill: it reads only AISA_API_KEY, uses outbound HTTPS to AIsa, and optionally writes a user-specified report file via --save.
Persistence & Privilege
No background service, autostart hook, privilege escalation, credential harvesting, local indexing, or persistence mechanism was found; file writes are limited to explicit user-requested output saving.
Scan Findings in Context
[LP3] expected: The scanner flagged least-privilege disclosure gaps, but the artifact does declare runtime requirements, primary env var, config schema, and network target; this is a documentation-governance note rather than evidence of hidden privilege.
[SQP-1] unexpected: The broad 'posting or engagement workflows' activation language is over-scoped relative to the inspected code, which performs analysis and searches only; this should be tightened but does not by itself show malicious or high-impact mutation capability.
[SQP-2] expected: External processing of prompts, search terms, and aggregated signals is core to the skill and visible in the docs and code, but the package should add clearer privacy, retention, and consent language for sensitive research topics.
[E1] expected: The external transmissions to api.aisa.one are expected for this cloud-backed aggregator and are declared in manifests and examples; no evidence showed unrelated exfiltration targets or secret leakage beyond the supplied AIsa bearer token used for authentication.
Assessment
Install only if you are comfortable sending forecast questions, derived search terms, and returned social/news/market signals to AIsa-hosted services using your AISA_API_KEY. Do not use it with confidential business plans, regulated personal data, secrets, or private investment research unless AIsa's data handling terms fit your needs.Verification
Tags
Trend Forecast Plugin
ClawHub/OpenClaw native-first plugin wrapper for the packaged AIsa skill.
Runtime Requirements
- Required bins:
python3 - Required env vars:
AISA_API_KEY - Primary env:
AISA_API_KEY - Network targets:
https://api.aisa.one
What It Ships
- Bundle plugin id:
trend-forecast-plugin - Native manifest:
openclaw.plugin.json - Native entrypoint:
index.js - Embedded skill:
skills/trend-forecast/SKILL.md - Format: native OpenClaw plugin plus Claude-compatible bundle fallback
Why This Format
- Uses the OpenClaw-native manifest path that current plugin docs expect.
- Keeps the packaged skill payload intact under
skills/for ClawHub/OpenClaw skill loading. - Retains
.claude-plugin/plugin.jsonso Claude-compatible marketplace tooling still recognizes the package. - Reuses the already-hardened
clawhub-release/skill payload.
Provenance
- Source repository:
https://github.com/baofeng-tech/agent-skills-io - Embedded skill path:
skills/trend-forecast/SKILL.md - The runtime behavior remains inside the packaged skill payload and its public docs.
Install After Publishing
openclaw plugins install clawhub:trend-forecast-plugin
Publish Locally
clawhub package publish ./plugins/trend-forecast-plugin --dry-run
clawhub package publish ./plugins/trend-forecast-plugin
Notes
- Runtime requirements and guardrails remain inside
skills/trend-forecast/SKILL.md. - If both native and bundle markers exist, OpenClaw prefers the native plugin path.
- This package keeps side effects explicit and relies on the packaged skill's repo-local defaults where applicable.
