Trading DevBox

Trading strategy development sandbox. User describes trading intent in natural language, agent writes a Python backtest strategy and returns results.

Security Scan

The skill's description promises running backtests and returning results, but the runtime instructions are incomplete and inconsistent (no data sources, no dependency/install steps, and the provided script only prints a placeholder), so the skill's actual behavior doesn't match its stated purpose.

Purpose & Capability

The skill claims to write and run Python backtests and return results, but it declares no required binaries, dependencies, or credentials. The SKILL.md references backtrader (a third‑party Python package) and backtesting over market data, yet gives no instructions for obtaining market data, installing backtrader, or accessing exchange/data APIs. These omissions are disproportionate to the stated capability.

Instruction Scope

The instructions tell the agent to write /tmp/trading-devbox/strategy.py and run python3 on it. The included strategy.py imports backtrader but only outputs a JSON status message and does not actually perform a backtest or load any market data. There is no guidance about data sources, credentials, or where to store results. Writing files and executing Python is expected for a devbox, but the steps are incomplete and grant the agent discretion to install packages or fetch data if it attempts to complete the workflow — this ambiguity is risky.

Install Mechanism

No install spec is provided (instruction-only), which keeps risk lower because nothing is preinstalled by the skill. However, the instructions import backtrader without telling the agent how to install it; a real agent might attempt to pip install packages at runtime, which could pull arbitrary code from PyPI. The absence of explicit, pinned install steps is a missing and notable detail.

Credentials

The skill requests no environment variables, no credentials, and no config paths. This is proportionate to the stated purpose on its face, but because backtesting usually requires market data or exchange API keys, the lack of declared data/credential requirements may indicate incomplete design rather than excessive privilege requests.

Persistence & Privilege

always is false, the skill is user-invocable, and there is no indication it attempts to modify other skills or system-wide settings. File writes are limited to /tmp in the instructions. No elevated persistence behavior is requested.

What to consider before installing

This skill is internally inconsistent: it says it will run backtests and return results but the runtime instructions only write a template script to /tmp and print a placeholder; it doesn't provide data sources or dependency installation steps (backtrader is imported but not installed). Before installing or running this skill: 1) Ask the author to clarify how market data is obtained and where results are stored; 2) Request explicit, pinned install steps for dependencies (e.g., pip install backtrader==<version>) rather than leaving the agent to fetch packages; 3) Require the agent to seek explicit user confirmation before executing any generated code or installing packages; 4) Run the skill in an isolated/containerized environment and review the generated strategy.py before execution to avoid arbitrary code running on your machine; 5) If the skill will access exchange APIs, ensure it requests only the minimal credentials needed and documents how they are used. These changes would resolve the main incoherences; absent them, treat the skill cautiously.

Help users develop and backtest trading strategies from natural language descriptions.

When to Use

• User describes a trading idea or intent (e.g. "SOL 跌 10% 买入，涨 30% 止盈")
• User asks to write, backtest, or optimize a trading strategy
• User mentions keywords: 策略, 回测, backtest, strategy, trading

Workflow

1. Parse the user's trading intent into structured parameters:

   • Asset (e.g. SOL, BTC, ETH)
   • Entry condition (e.g. price drops 10%)
   • Exit condition (e.g. take profit at 30%, stop loss at 5%)
   • Timeframe (e.g. 1h, 4h, 1d)

2. Confirm the parsed parameters with the user before proceeding.

3. Generate a Python backtest strategy using backtrader:

mkdir -p /tmp/trading-devbox && cat > /tmp/trading-devbox/strategy.py << 'PYEOF'
import backtrader as bt
import sys
import json

class UserStrategy(bt.Strategy):
    params = dict(
        entry_drop_pct=10,
        take_profit_pct=30,
        stop_loss_pct=5,
    )

    def __init__(self):
        self.order = None
        self.buy_price = None

    def next(self):
        if self.order:
            return
        if not self.position:
            # entry: price dropped by entry_drop_pct from recent high
            high = max(self.data.close.get(size=20) or [self.data.close[0]])
            drop = (high - self.data.close[0]) / high * 100
            if drop >= self.p.entry_drop_pct:
                self.order = self.buy()
                self.buy_price = self.data.close[0]
        else:
            pnl = (self.data.close[0] - self.buy_price) / self.buy_price * 100
            if pnl >= self.p.take_profit_pct or pnl <= -self.p.stop_loss_pct:
                self.order = self.sell()

if __name__ == '__main__':
    print(json.dumps({"status": "ok", "message": "Strategy generated"}))
PYEOF
python3 /tmp/trading-devbox/strategy.py

4. Report the result to the user in a clear format.

Response Format

Always respond in the user's language. Structure the response as:

• Parsed intent summary
• Strategy parameters
• Execution result or next steps