ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

DR. Trading System

v1.0.1

Reusable framework skill for designing and setting up strategy-job trading systems with shared engine logic, config-driven jobs, pluggable market-data provid...

⭐ 0· 41·0 current·0 all-time
byDaniel Refahi@daniel-refahi-ikara
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
ℹ
Purpose & Capability
Name/description match the provided modules: engine, provider adapter, wizard, config examples, and reporting. The implementation expects a provider adapter that launches a Python interpreter (futu/OpenD usage) and reads/writes local workspace files; however the registry metadata declared no required binaries even though the provider adapter needs a python binary and provider-side SDK at runtime. This omission is likely an oversight but worth confirming.
✓
Instruction Scope
SKILL.md confines work to conversational setup and generating local deployment files and explicitly warns to keep secrets/credentials outside the reusable skill package. Runtime code reads/writes only workspace-tier files (jobs, watchlists, state, reports) and invokes a provider adapter to fetch market data — behavior consistent with the described scope. Note: the moomoo_opend adapter execs a Python process (with an embedded Python snippet) to call a provider; that runtime execution is expected for this adapter but you should confirm python_bin and provider host settings before running.
✓
Install Mechanism
There is no install spec (instruction-only skill), so nothing in the bundle is automatically downloaded or executed outside the local workspace. All code is included in the skill package; no external installers or remote downloads are used.
ℹ
Credentials
The skill requests no environment variables or external credentials in metadata. Runtime requires provider connection configuration (host, port, python_bin) stored in local deployment configs — these are proportional to the provider-adapter purpose. Be aware the adapter will use the python_bin path you supply; sensitive credentials (API keys, provider session tokens) are expected to live in your local configs and the skill explicitly instructs to keep them out of the reusable package.
✓
Persistence & Privilege
always is false and the skill does not request elevated platform privileges. It reads and writes files under the specified workspace rootDir (state, reports, configs) which is appropriate for its function. It does not modify other skills or global agent settings.
Assessment
This package appears to do what it says: a local, paper-first trading-job framework with a conversational setup wizard and a provider adapter that runs a Python snippet to fetch market data. Before installing or running it, check these items: - Python/runtime and provider SDK: The moomoo adapter runs a Python interpreter you supply (connection.python_bin) and expects the futu/OpenD library. Make sure python_bin points to a trusted interpreter with the required packages installed. - Provider host: The adapter will connect to the host:port you configure. Confirm you intend to connect to that endpoint (defaults to 127.0.0.1:11111 in examples) and do not accidentally point it at an untrusted remote host. - Workspace file writes: The skill reads/writes local workspace files (jobs, watchlists, state, reports). Keep secrets, credentials, and provider session tokens out of the reusable skill package (the SKILL.md repeatedly warns this). - Execution surface: The skill spawns a Python process using execFile to execute an embedded script. That is necessary for the adapter but means the skill can execute code using whatever python_bin you supply — ensure that interpreter is secure. - Start safe: Follow the skill's own guidance: run in daily-assessment/paper mode, validate provider freshness and report sanity, and test with a small watchlist before trusting proposals or moving to any live execution. If you want higher assurance, run the skill in an isolated environment, inspect the provider configs you generate, and ensure python_bin and provider dependencies are controlled. If you find missing runtime requirements in registry metadata (e.g., python requirement), consider asking the publisher to update the metadata before wide deployment.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ebrgmqzqqsaqmhz4xmkk0m983z77s

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments