Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Tearsheet Generator
v0.1.0Generate professional tearsheets with custom SVG visualizations using the QuantStats library. Creates performance reports with MAE analysis, leverage recomme...
⭐ 0· 350·0 current·0 all-time
byDan Repaci@ahuserious
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description describe tearsheet generation and MAE-based leverage recommendations, which aligns with the included Python helpers. However the SKILL.md repeatedly references external integrations (Nautilus Trader, Hyperliquid SDK, Ray Tune, a local path /Users/DanBot/Desktop/dev/Backtests/backtesting/tearsheets/strategy_comparison_tearsheet.py) and a 'Nautilus Verified' workflow. Those integrations would normally require credentials and/or specific binaries - yet the skill declares no required env vars or binaries. Hard-coded absolute dev paths are unexpected for a distributable skill.
Instruction Scope
Instructions tell the agent to read arbitrary user-specified CSV/JSON files and to import/execute code from an absolute local path; they also instruct running verification with Nautilus Trader and applying leverage via SDKs. The skill's header allows Read/Write/Edit/Bash/Glob which would permit executing shell commands and reading/writing files anywhere the agent can access. There are no explicit limits or safeguards in the instructions about what files/paths or external systems to contact.
Install Mechanism
There is no install spec (instruction-only plus one helper module included). That lowers supply-chain risk. The included Python helper file contains no obfuscated code or obvious network calls. No remote downloads or extraction steps are present.
Credentials
The skill references external services (Nautilus Trader, Hyperliquid) and integration points that normally require API keys, SDK access, or local binaries, but the registry metadata lists no required environment variables, credentials, or config paths. This mismatch means either the integration will silently fail or the runtime may try to access local credentials or prompt the agent to obtain them—both are potential security concerns.
Persistence & Privilege
always:false (good). The skill allows Read/Write/Edit/Bash which lets it create files (tearsheets, JSON) and run commands; that is expected for a report generator but increases risk if the agent is allowed to run autonomously with those tools. The skill does not request persistent platform privileges or alter other skills.
What to consider before installing
Things to check before installing or running:
- Inspect or run the code in a sandbox: review the included tearsheet_helpers.py and any referenced script (strategy_comparison_tearsheet) before executing. The helper module looks benign, but you should verify there are no hidden network calls in other files.
- Ask the author to explain integrations: the SKILL.md references Nautilus Trader and Hyperliquid SDK but the skill declares no credentials or required binaries. If you expect those features, require the skill to explicitly declare the environment variables and binaries it needs.
- Remove or change hard-coded absolute paths: the README points to /Users/DanBot/Desktop/dev/Backtests which is a local dev path — the skill should accept relative or configurable paths instead of hard-coded ones.
- Limit agent permissions: because allowed-tools includes Bash/Read/Write/Edit/Glob, run the skill in an isolated environment (container/VM) or reduce allowed tools if possible, especially if you will provide real trading account configs.
- Do not run with real account credentials or live trading enabled: any integration that can apply leverage or call exchange SDKs should only be used with test accounts after you confirm what network calls the skill makes.
- Request missing details from the publisher: ask for (1) a clear list of external services the skill will call, (2) which env vars/credentials are required and why, and (3) a non-dev installation path or packaging instructions.
If you only need local report generation from CSVs and will run everything offline, the skill appears functionally coherent after fixing the absolute paths; if you plan to use verification or SDK features, require the author to make credentials and network calls explicit and auditable.Like a lobster shell, security has layers — review code before you run it.
latestvk979j1ty2d02m0nak651vyepc581zvj5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.