investorclaw-8d2df3 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited investorclaw-8d2df3 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- SPDX-License-Identifier: MIT-0 Copyright 2026 InvestorClaw Contributors
This SKILL.md is MIT-0-licensed. The InvestorClaw service it connects to is Apache 2.0. See the InvestorClaw repository for that license. -->
Powered by InvestorClaw (Apache 2.0). This skill file is MIT-0-licensed; the underlying service is Apache 2.0.
InvestorClaw is a containerized portfolio-analysis service exposed to openclaw as two MCP-HTTP servers:
investorclaw — portfolio analysis tools at http://localhost:18090/mcpmnemos — memory + knowledge graph at http://localhost:5002/mcpBoth run inside a Docker compose stack on the user's machine (docker compose up -d is the entire service install). openclaw connects to them as native MCP servers via its mcp.servers config block — no plugin manifest, no dist/index.js, no npm install, no skill bootstrap files.
If openclaw runs in a container itself, the two MCP URLs reach the host's loopback through the compose bridge network or host.docker.internal, depending on how the openclaw container is launched. See INSTALL.md.
When the service is running, openclaw's tool catalog gains:
investorclaw.*)investorclaw.portfolio_ask — natural-language portfolio questionrouted through the deterministic engine
investorclaw.portfolio_holdings — current snapshot of positions,values, weights
investorclaw.portfolio_performance — Sharpe, volatility, top/bottomperformers, max drawdown
investorclaw.portfolio_bonds — bond analytics (YTM, duration, FREDyield curve)
investorclaw.portfolio_analyst — analyst ratings per holdinginvestorclaw.portfolio_news — news correlation for held positionsinvestorclaw.portfolio_lookup — ticker / account lookupinvestorclaw.portfolio_optimize — Sharpe / min-vol optimizationinvestorclaw.portfolio_rebalance — current vs target with tax impactinvestorclaw.portfolio_scenario — what-if scenarios on holdingsinvestorclaw.portfolio_cashflow — projected cashflow from bondsinvestorclaw.portfolio_peer — peer comparison vs benchmarkinvestorclaw.portfolio_setup — auto-discover portfolio files in/data/portfolios/
investorclaw.portfolio_refresh — refresh market data withoutre-uploading files
investorclaw.portfolio_guardrails — view educational-only guardrailsmnemos.*)mnemos.search_memories — full-text + semantic search acrossremembered observations
mnemos.create_memory — record an observation about the user'spreferences, prior questions, or current investing context
mnemos.list_memories — browse by category / dateUsers ask portfolio questions in openclaw chat. The LLM sees the MCP tools in its function-calling schema and routes the question to the right tool automatically. Examples:
investorclaw.portfolio_holdingsinvestorclaw.portfolio_performancemnemos.search_memories| Intent | Phrasing |
|---|---|
| Holdings | "What's in my portfolio?" • "Show me my positions" |
| Performance | "How am I doing this year?" • "What's my Sharpe ratio?" |
| Bonds | "Show me my bond exposure and yield-to-maturity" |
| Allocation | "What's my sector exposure?" |
| Optimization | "Help me rebalance to a 60/40 target" |
| Market data | "What's the current price of NVDA?" |
| News | "Today's news on my holdings" |
| Reports | "Generate today's EOD report" • "Prepare an advisor brief" |
The first call after a cold cache may take 30–60 seconds while the deterministic pipeline builds the signed envelope; subsequent calls reuse the cache.
A typical flow:
mnemos.search_memories for prior portfoliocontext.
investorclaw.portfolio_holdings for the current snapshot.mnemos.create_memory to record salient observations fromthe review.
openclaw's chat completion goes through whichever provider is configured in models.providers.<name> of ~/.openclaw/openclaw.json. Anthropic on openclaw — paid path only since 2026-04-04: routing OAuth- subscription tokens to a claws-agent violates Anthropic's ToS per their Apr 3 announcement. To use Anthropic models you need either (a) the discounted "extra usage bundle" add-on for your subscription, or (b) a direct Anthropic API key. Even with paid credits, Anthropic isn't cost-competitive with Together for InvestorClaw narrative work; we don't deploy Anthropic on our own fleet for openclaw.
Recommended:
google/gemma-4-31B-it — serverlesstier, ~100 tok/s, ~$0.0008 / 1 K tokens, fleet default. This is what the InvestorClaw container expects via INVESTORCLAW_NARRATIVE_MODEL.
MiniMaxAI/MiniMax-M2 —larger context, but moved off Together's serverless tier 2026-05; requires a paid dedicated endpoint.
gemma4:e4b on host — zero cloudcost, GPU-bound, no key required.
Set TOGETHER_API_KEY in the InvestorClaw container's portfolios/keys.env (or via portfolio_keys_set) so the engine can synthesize narratives directly. openclaw's own model config is a separate concern.
After delivering analysis, the LLM should record only non-obvious observations the user might want next time — not every detail, just the ones that would be hard to recover from re-reading the data.
response includes a structured ic_result envelope plus a narrative text body. Trust the structured envelope — it is the source of truth. The narrative is decoration. If a portfolio file format isn't recognized, the tool returns a structured error with detected columns; surface that error and direct the user to the dashboard's column-mapping wizard at http://localhost:18092/portfolios/map.
the disclaimer envelope. Echo it when summarizing for the user. Do not recommend buying, selling, or holding specific securities.
localhost:18090 andlocalhost:5002. If the user deploys remotely (Tailscale VM, cloud host), the URLs change but the tool surface is identical.
its chat completions through models.providers.<name> in ~/.openclaw/openclaw.json (Together, OpenAI, Ollama, etc.). That is unrelated to InvestorClaw's optional narrative tier, which is configured inside the InvestorClaw dashboard at http://localhost:18092/.
v4.0 eliminates the v2.x openclaw install friction:
openclaw.plugin.json manifest (there is no plugin)dist/index.js (there is no plugin shim to compile)BOOTSTRAP.md / IDENTITY.md /USER.md) to seed
for the plugin
The integration is just two MCP server URLs. openclaw's existing native MCP support handles the rest.
OpenClaw / ZeroClaw / Hermes (ClawHub):
clawhub install investorclawClaude Code / Claude Desktop:
/plugin marketplace add argonautsystems/InvestorClaw
/plugin install investorclawSee INSTALL.md in this directory for manual install steps.
This SKILL.md describes how openclaw connects to the InvestorClaw service. If a tool returns an unexpected result, the issue is in the service (Apache 2.0 — mnemos-os/mnemos-ic-runtime and argonautsystems/InvestorClaw), not in this file. If openclaw fails to register the MCP servers, see INSTALL.md in this directory — in particular the note about always using the validated openclaw mcp set / openclaw config patch CLI rather than editing openclaw.json by hand.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.