Portfolio Manager

### Quick judgment A capable, instruction-only portfolio analysis skill that is **technically strong but operationally and security-wise imperfect**. It is worth using **only if** you: - Already have an Alpaca MCP server properly configured, or - Are comfortable managing Alpaca API keys safely (ideally paper/read-only keys), and - Understand that the registry metadata does **not** fully disclose the credential requirements. For non-technical users or anyone uncomfortable handling broker API keys, this should be used cautiously or avoided in favor of safer, CSV/manual-input workflows. ### What it does well - **Deep portfolio analysis**: Covers asset allocation, diversification, risk metrics, performance review, and position-level recommendations, with highly structured output sections. - **Good MCP integration design**: Explicit use of Alpaca MCP tools (`get_account_info`, `get_positions`, `get_portfolio_history`) and a clear workflow for fetching and validating portfolio data. - **Usable reporting**: Produces well-organized, human-readable reports (tables and sectioned summaries) suitable for quick reviews or client-style summaries. ### Key risks and concerns 1. **Credential transparency mismatch** - The documentation instructs you to provide **ALPACA_API_KEY**, **ALPACA_SECRET_KEY**, and config files, and even mentions direct Alpaca API calls as a fallback. - The **skill metadata does not declare any required credentials**. This inconsistency can mislead users into underestimating the sensitivity of what they’re providing. 2. **Security scan flags (medium suspicion)** - OpenClaw’s scan notes the plausible purpose but highlights **incoherent metadata and instructions**: reliance on credentials and local config that are not declared, and broken filename references. - While there is no auto-install step (reducing immediate code-execution risk), the repo suggests running scripts (e.g., `scripts/test_alpaca_connection.py`). Any such script should be **manually inspected** before execution. 3. **Scope and environment inconsistencies** - SKILL.md references a setup file `references/alpaca_mcp_setup.md` while the repo contains `references/alpaca-mcp-setup.md` — a broken reference that indicates some maintenance sloppiness. - The skill expects MCP tools and environment variables/config files that are **not declared in the registry metadata**, which can cause confusion and setup failures. 4. **Live trading key risk** - Nothing in the metadata concretely warns users to **prefer paper or read-only keys**. A user might inadvertently provide full live-brokerage credentials. Even if the code *intends* read-only usage, the absence of precise documentation about access scopes is a risk. ### When it’s appropriate to use Best suited for: - **Technical or advanced retail users** who: - Already use Alpaca and understand MCP and API keys. - Can safely manage environment variables and config files. - Are comfortable inspecting any optional test scripts before running them. - **Paper-trading or test environments**, where the consequence of credential misuse is minimal. - **Portfolio review sessions** where real-time positions and history from Alpaca MCP are important and you’re willing to accept some integration friction. Use with extra caution or avoid when: - You are **not comfortable** handling broker API keys or configuring MCP servers. - You cannot verify what additional tools/scripts (if any) might do with your credentials. - You only need **high-level, hypothetical portfolio advice** that doesn’t require direct broker integration—simpler, non-credentialed skills may be safer. ### Recommended safeguards if you install - Use **paper-trading or read-only Alpaca keys**, never full live-trading keys if you can avoid it. - Do **not** paste secrets into chat; set them via environment variables or properly permissioned config files. - If you choose to run any repo scripts (e.g., test scripts), **review their source code first** and run them in an isolated environment (container/VM) where possible. - Treat the current version as **beta-quality** from a security/metadata standpoint and re-evaluate once the publisher: - Declares required credentials explicitly in metadata, and - Fixes filename / documentation inconsistencies. ### Overall A functionally rich, well-structured portfolio-analysis skill for Alpaca users, but with **metadata/credential hygiene issues and moderate security concerns**. Good fit for technically capable users in controlled environments; not ideal for beginners or anyone sensitive about broker credential handling.