Back to skill
Skillv1.0.2
ClawScan security
rqalpha · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 23, 2026, 10:01 AM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is internally consistent with a backtesting framework: it only requires python3, documents installing rqalpha via pip, and the instructions/files match that purpose.
- Guidance
- This package appears to be a straightforward wrapper/documentation for the RQAlpha backtesting library. Before installing, consider: (1) install and run it inside a virtualenv or container to isolate dependencies; (2) verify you trust the pip package source and version (rqalpha>=5.0.0) and review its upstream repository if you need assurance; (3) note that rqalpha download-bundle will fetch market data from external sources — ensure you are comfortable with network access and data provenance; (4) minor metadata mismatches (version strings/owner IDs in included files) look cosmetic but you may want to confirm the publisher if provenance is important.
Review Dimensions
- Purpose & Capability
- okName/description, README, SKILL.md and requirements.txt all describe an RQAlpha backtesting skill. Required binaries (python3) and listed Python package dependencies are appropriate for the stated purpose.
- Instruction Scope
- okSKILL.md instructs installing rqalpha via pip, downloading data bundles, running backtests, and using the library API. It does not direct reading unrelated files, collecting environment secrets, or sending data to unexpected endpoints.
- Install Mechanism
- okThere is no automatic install spec (instruction-only). The docs instruct the user to pip install rqalpha and to run rqalpha download-bundle — standard for a Python library. requirements.txt lists expected packages.
- Credentials
- okThe skill requests no environment variables, credentials, or config paths. The dependencies are typical Python packages required for a backtesting toolkit.
- Persistence & Privilege
- okalways is false and the skill does not request persistent or elevated agent privileges, nor does it modify other skills or system-wide agent settings.