Xanadu Portfolio Optimizer

Optimize investment portfolios with rebalancing, risk analysis, tax-loss harvesting, and calculate optimal asset allocation.

Security Scan

The optimizer code largely matches the stated purpose, but the repository contains inconsistent/copy-paste billing code and a hard-coded SkillPay API key (sensitive credential) that is not declared in the skill metadata — review and remediate before installing or running.

Purpose & Capability

The core optimizer (scripts/optimizer.py) implements portfolio analysis, rebalancing, and tax-loss harvesting consistent with the skill description. The repository also includes billing-related files and a Monetization section in SKILL.md, so payment integration is plausible. However, billing.py's module docstring and default SKILL_ID reference a different product ('Social Media Manager'), indicating a copy/paste or packaging inconsistency.

Instruction Scope

SKILL.md instructs running scripts/optimizer.py for analyze/rebalance/harvest; those routines only fetch price data (via yfinance) and perform local calculations and prints. The instructions do not direct the agent to read unrelated system files or to call the billing API. Still, runtime behavior includes network calls to Yahoo Finance (via yfinance) and the repo contains a separate billing module that would contact an external SkillPay API if invoked.

Install Mechanism

No install script is provided (instruction-only skill with bundled scripts). This is low-risk from an installation perspective. The SKILL.md lists reasonable Python dependency requirements (yfinance, numpy, pandas) which match the code usage.

Credentials

The repository contains scripts/billing_config.py with a hard-coded SKILLPAY_API_KEY and OWNER_WALLET (sensitive credential and wallet address), yet the skill metadata declares no required environment variables or credentials. Embedding an API key in code is disproportionate and risky: keys in repo can be abused. Billing code also posts the API key to https://api.skillpay.me/v1, which is expected for monetization but should be configured via environment variables rather than a committed secret. The mismatch between declared requirements (none) and included credentials is a red flag.

Persistence & Privilege

The skill does not request 'always: true' or any elevated platform privileges, and it does not modify other skills or system-wide agent settings. It appears user-invocable only, which is appropriate.

What to consider before installing

This skill's optimizer code appears to do what it says (portfolio analysis, rebalancing, tax-loss harvesting) and requires network access to fetch prices. However, the repository includes billing code with a hard-coded SkillPay API key and some copy/paste inconsistencies (billing docstring referencing a different product). Before installing or running: (1) Do not run this in a sensitive or production environment until reviewed. (2) Treat the SKILLPAY_API_KEY in scripts/billing_config.py as a leaked secret — rotate it if it belongs to you, and remove hard-coded keys from the repo. (3) Prefer billing configuration via environment variables (not committed files). (4) Audit billing.py usage paths — confirm whether the billing API is actually invoked by your agent flows and whether the key has been used. (5) If you don't need monetization, remove or disable the billing files. (6) Run the code in an isolated sandbox or VM and review network calls (yfinance to Yahoo, and any calls to api.skillpay.me). (7) Contact the skill author (verify identity) or avoid installing until they fix the embedded secret and clarify the billing integration. If you want, I can produce exact remediation steps or help create a safer wrapper that strips billing before use.

Portfolio Optimizer

Optimize investment portfolios with rebalancing, risk analysis, and tax optimization.

Quick Start

# Analyze portfolio
python scripts/optimizer.py analyze --holdings AAPL:10,MSFT:15,GOOGL:5

# Rebalance
python scripts/optimizer.py rebalance --holdings AAPL:10,MSFT:15,GOOGL:5 --target "AAPL:30,MSFT:30,GOOGL:40"

# Tax-loss harvest
python scripts/optimizer.py harvest --holdings AAPL:-500,MSFT:200

Core Features

1. Portfolio Analysis

• Current allocation breakdown
• Sector exposure
• Risk metrics (volatility, beta, Sharpe ratio)
• Diversification score
• Performance vs benchmarks

2. Rebalancing

Calculate trades needed to reach target allocation:

• Threshold-based rebalancing (e.g., rebalance when >5% drift)
• Calendar-based (quarterly, annually)
• Tax-aware rebalancing (minimize capital gains)

3. Tax-Loss Harvesting

Identify positions with losses to offset gains:

• Short-term vs long-term losses
• Wash sale rule awareness
• Suggested replacement securities

4. Risk Analysis

• Portfolio volatility
• Maximum drawdown
• Value at Risk (VaR)
• Beta vs market
• Correlation matrix

Usage

Analyze Current Portfolio

python scripts/optimizer.py analyze --holdings AAPL:10,MSFT:15,GOOGL:5

Get Rebalancing Trades

python scripts/optimizer.py rebalance \
  --holdings AAPL:10000,MSFT:15000,GOOGL:5000 \
  --target "AAPL:33,MSFT:33,GOOGL:33"

Tax-Loss Harvesting Opportunities

python scripts/optimizer.py harvest --file portfolio.json

Risk Report

python scripts/optimizer.py risk --holdings AAPL:10,MSFT:20,GOOGL:5

Input Format

Holdings can be specified as:

• SYMBOL:VALUE (dollar value)
• SYMBOL:SHARES:AVG_COST (shares with cost basis)

Example:

--holdings AAPL:15000,MSFT:20000,GOOGL:5000

Or with cost basis:

--holdings "AAPL:100:150.00,MSFT:50:280.00"

Output

Analysis includes:

• Current vs target allocation
• Trades needed to rebalance
• Estimated tax impact
• Risk metrics
• Recommendations

Requirements

• Python 3.10+
• yfinance for price data
• numpy, pandas for calculations

---

Monetization (SkillPay)

This skill supports SkillPay integration for premium features.

Pricing Tiers

Tier	Price	Features
Basic	Free	Basic analysis, manual rebalancing
Pro	$29/mo	Auto rebalancing, tax-loss harvesting, risk metrics
Premium	$49/mo	API access, unlimited portfolios, priority support

Owner: Xanadu Studios