Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Bt Portfolio Backtest

v0.3.3

使用 bt 框架构建和回测多策略投资组合,支持风险平价、等风险贡献、逆波动率加权等组合构建方法,以及政府债券滚动交易的模拟回测。

0· 110·0 current·0 all-time
byTang Weigang@tangweigang-jpg

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for tangweigang-jpg/bt-portfolio-backtest.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Bt Portfolio Backtest" (tangweigang-jpg/bt-portfolio-backtest) from ClawHub.
Skill page: https://clawhub.ai/tangweigang-jpg/bt-portfolio-backtest
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install bt-portfolio-backtest

ClawHub CLI

Package manager switcher

npx clawhub@latest install bt-portfolio-backtest
Security Scan
Capability signals
Crypto
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
Name/description advertise building/backtesting with the 'bt' framework, but SKILL.md, seed.yaml, and many reference files repeatedly mention ZVT, zvt-related preconditions, and a finance blueprint (finance-bp-125). The metadata also requires 'Python 3.12+ with uv package manager' even though the registry entry declares no required binaries or env vars. This mismatch (bt vs ZVT/blueprint, implied dependencies not declared) is disproportionate to the stated purpose and suggests either sloppy composition or embedded unrelated functionality.
!
Instruction Scope
Runtime instructions and seed.yaml require the agent to run precondition checks that import zvt, assert ZVT_HOME, touch files in ~/.zvt, and (on failure) run pip install and zvt init commands. SKILL.md also includes fatal 'semantic locks' (strict execution rules) and an execution_protocol that instructs re-reading seed.yaml and running host install recipes. None of these operations were declared in the skill's registry metadata; they access environment/config state beyond a simple 'write-only' helper and could cause the agent to attempt installs, filesystem writes, or network access to data providers.
Install Mechanism
There is no install spec (instruction-only), which reduces risk from arbitrary downloaded code. However seed.yaml's execution_protocol references install_recipes and package verification steps that are not provided here, and SKILL.md demands a specific Python+package manager environment. The absence of an explicit, consistent install recipe while embedding install instructions in text is inconsistent and worth noting.
Credentials
Registry reports no required env vars/credentials, yet the instructions reference and validate ZVT_HOME and rely on external data providers (eastmoney, joinquant, qmt, etc.) that may require credentials/accounts. The skill may prompt the agent to run pip installs and create/modify ~/.zvt. Requested environment access is not declared up-front, which is disproportionate to the listed metadata.
Persistence & Privilege
The skill does not set always:true and is user-invocable, which is appropriate. It does, however, instruct initialization of local data directories (zvt.init_dirs), touching files under ~/.zvt, and mandates re-reading seed.yaml before behavioral decisions (execution_protocol). Those are not global privileges, but they do give the skill potential to modify user-local config/data — the behavior is plausible for backtesting but should be made explicit.
What to consider before installing
This skill is internally inconsistent: it advertises 'bt' usage but its instructions and included artifacts are heavily ZVT/blueprint-centric and expect the agent to check/install zvt and manipulate ~/.zvt. Before installing or invoking it, ask the maintainer to clarify: (1) which framework is actually required (bt or zvt) and provide an explicit install spec; (2) list all required binaries and environment variables (e.g., ZVT_HOME) and any credential needs; (3) confirm whether the skill will run pip installs or write to your home directory. If you proceed, run it in a sandboxed environment, do not supply sensitive credentials, and review any pip install commands and scripts the agent would execute. If you cannot get clarification, treat the skill as untrusted and avoid running its automated precondition/install steps on your main system.

Like a lobster shell, security has layers — review code before you run it.

doramagic-crystalvk974wt4xd0ghpdzc10w60k8r2x85dh13financevk974wt4xd0ghpdzc10w60k8r2x85dh13latestvk974wt4xd0ghpdzc10w60k8r2x85dh13portfoliovk974wt4xd0ghpdzc10w60k8r2x85dh13quantvk974wt4xd0ghpdzc10w60k8r2x85dh13riskvk974wt4xd0ghpdzc10w60k8r2x85dh13
110downloads
0stars
4versions
Updated 4d ago
v0.3.3
MIT-0

bt 组合回测 (bt-portfolio-backtest)

使用 bt 框架构建和回测多策略投资组合,支持风险平价、等风险贡献、逆波动率加权等组合构建方法,以及政府债券滚动交易的模拟回测。

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (20 total)

Buy and Hold Monthly Rebalancing Strategy (UC-101)

Implements a passive buy-and-hold strategy with monthly rebalancing to fixed target weights, demonstrating core backtesting framework capabilities Triggers: buy and hold, monthly rebalance, fixed weights

Equal Risk Contribution Portfolio Construction (UC-102)

Demonstrates Equal Risk Contribution (ERC) portfolio weighting using multivariate normal returns and covariance matrix inputs for risk parity allocati Triggers: equal risk contribution, risk parity, covariance

Fixed Income Government Bond Rolling Strategy (UC-103)

Simulates rolling government bond trading with synthetic price-to-yield calculations and bond lifecycle management for fixed income backtesting Triggers: fixed income, government bonds, rolling bonds

For all 20 use cases, see references/USE_CASES.md.

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

  • Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
  • Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
  • Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
  • Time range: start_timestamp and end_timestamp for backtest period
  • Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

IDRuleOn Violation
SL-01Execute sell orders before buy orders in every trading cyclehalt
SL-02Trading signals MUST use next-bar execution (no look-ahead)halt
SL-03Entity IDs MUST follow format entity_type_exchange_codehalt
SL-04DataFrame index MUST be MultiIndex (entity_id, timestamp)halt
SL-05TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amounthalt
SL-06filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTIONhalt
SL-07Transformer MUST run BEFORE Accumulator in factor pipelinehalt
SL-08MACD parameters locked: fast=12, slow=26, signal=9halt

Full lock definitions: references/LOCKS.md

Top Anti-Patterns (25 total)

  • AP-ZVT-183: 除权因子为 inf/NaN 时直接参与乘法导致复权静默失败
  • AP-ZVT-179: 第三方数据接口超限后异常被吞噬,数据静默缺失
  • AP-ZVT-183B: HFQ(后复权)与 QFQ(前复权)K 线表使用错误导致因子计算漂移

All 25 anti-patterns: references/ANTI_PATTERNS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-125. Evidence verify ratio = 10.0% and audit fail total = 14. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

FileContentsWhen to Load
references/seed.yamlV6+ 全量权威 (source-of-truth)有行为/决策争议时必读
references/ANTI_PATTERNS.md25 条跨项目反模式开始实现前
references/WISDOM.md跨项目精华借鉴架构决策时
references/CONSTRAINTS.mddomain + fatal 约束规则冲突时
references/USE_CASES.md全量 KUC-* 业务场景需要完整示例时
references/LOCKS.mdSL-* + preconditions + hints生成回测/交易代码前
references/COMPONENTS.mdAST 组件地图(按 module 拆分)查 API 时

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-125 blueprint at 2026-04-22T13:01:02.252610+00:00. See human_summary.md for non-technical overview.

Comments

Loading comments...