Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Trading Quant

v1.0.0

量化交易数据分析工具。A股/美股/港股/贵金属实时行情,多维度评分(技术面+资金面+基本面),涨跌停池,北向资金,分钟级资金流。Use when: (1) 查询任何股票实时行情和评分, (2) 分析A股涨跌停异动, (3) 查看北向资金流向, (4) 美股港股贵金属行情, (5) 全球市场概览, (6) 个股资金...

0· 146·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for onlyloveher/cn-stock-analyzer.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Trading Quant" (onlyloveher/cn-stock-analyzer) from ClawHub.
Skill page: https://clawhub.ai/onlyloveher/cn-stock-analyzer
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install cn-stock-analyzer

ClawHub CLI

Package manager switcher

npx clawhub@latest install cn-stock-analyzer
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description align with the included code: multiple data-source modules (Tencent, Sina, EastMoney, yfinance, akshare), scoring, technical/capital/sentiment analysis — these are expected. One mismatch: industry_classifier attempts to prefill from a watchlist at a relative path that climbs out of the package (../../../../..../knowledge/watchlist.json), which accesses files outside the skill bundle; this is not strictly required to provide the advertised functionality and could read unrelated user/agent data.
!
Instruction Scope
SKILL.md instructs running local Python scripts (quant.py) — expected. However, the runtime code may read and persist local files (e.g., /tmp/quant_industry_cache.json, ~/.cache/huggingface, and the external 'knowledge/watchlist.json' path outside the skill directory). The sentiment component also downloads HuggingFace models if not cached (network activity and large model files). The instructions do not call out these external file reads or large downloads, so the runtime behavior is broader than the SKILL.md description.
Install Mechanism
No install spec (instruction-only) and a requirements.txt lists standard Python libraries. This lowers install risk, but the sentiment module can download models from HuggingFace at runtime (expected for FinBERT-like analysis) — that will write large artifacts to the cache and perform outbound network requests.
Credentials
The skill does not declare required environment variables, credentials, or secrets. It uses optional environment variables (TRADING_WORKSPACE) to choose a workspace root and relies on default cache locations (e.g., ~/.cache/huggingface). No tokens/keys are requested, so credential scope is proportionate to the stated purpose.
Persistence & Privilege
always:false and agent invocation is normal. The code writes caches to /tmp, the HuggingFace cache (~/.cache/huggingface), and may create a workspace under ~/.openclaw/workspace-trading (or TRADING_WORKSPACE if set). It also persists an industry cache file at /tmp/quant_industry_cache.json. These are expected for this class of tool but do create persistent files on the host.
What to consider before installing
This skill appears to implement a real trading-analysis tool, but review these things before installing or running it: - Watchlist / external file access: industry_classifier tries to read a file at a relative path that escapes the package (../../../../..../knowledge/watchlist.json). That will access files outside the skill bundle if present — verify what that path would resolve to in your environment and ensure it won't read sensitive data. - Model downloads and network: the sentiment module can download HuggingFace models at runtime (large files and outbound network calls). If you need to restrict network or disk usage, run the skill in a sandbox/container, or pre-populate the model cache. - Persistent files: it writes caches to /tmp, ~/.cache/huggingface, and a workspace directory (~/.openclaw/workspace-trading by default). Clean these if you uninstall or run in an ephemeral environment. - No credentials requested: the skill doesn't require API keys or secrets in its metadata. However, the code relies on public data sources (Tencent, Sina, EastMoney, akshare, yfinance). If you plan to integrate private credentials later, inspect where those would be provided. - Dependency management: requirements.txt exists but no installer is provided. Pin and review Python package versions before pip installing; consider using a virtualenv. If you are uncomfortable with the external-file reads or model downloads, run the skill only in an isolated/containerized environment, or ask the author to remove or make explicit the watchlist-prefill behavior and to document expected network and disk usage.

Like a lobster shell, security has layers — review code before you run it.

latestvk9748qqx3pgzv7t317r484257d83axk9
146downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

量化交易数据分析

通过腾讯/新浪/东财/同花顺多数据源获取实时行情,提供5维评分体系。

工具列表

所有工具统一入口:

python3.12 {baseDir}/scripts/quant.py <tool> [args...]

A股分析

python3.12 {baseDir}/scripts/quant.py stock_analysis [codes]
python3.12 {baseDir}/scripts/quant.py intraday_snapshot

全球市场

python3.12 {baseDir}/scripts/quant.py us_stock [symbols]
python3.12 {baseDir}/scripts/quant.py hk_stock [codes]
python3.12 {baseDir}/scripts/quant.py commodity [codes]
python3.12 {baseDir}/scripts/quant.py global_overview

市场数据

python3.12 {baseDir}/scripts/quant.py market_anomaly
python3.12 {baseDir}/scripts/quant.py market_scan
python3.12 {baseDir}/scripts/quant.py top_amount [N]
python3.12 {baseDir}/scripts/quant.py capital_flow [codes]
python3.12 {baseDir}/scripts/quant.py northbound_flow
python3.12 {baseDir}/scripts/quant.py gold_analysis
python3.12 {baseDir}/scripts/quant.py margin_data [code]
python3.12 {baseDir}/scripts/quant.py lhb [date]
python3.12 {baseDir}/scripts/quant.py main_flow [codes]

维护

python3.12 {baseDir}/scripts/quant.py warm_klines
python3.12 {baseDir}/scripts/quant.py save_daily
python3.12 {baseDir}/scripts/quant.py system_health

评分体系

维度权重指标
技术面25%MACD/RSI/KDJ/均线/布林
资金面30%量比/换手率/量价/主力资金
基本面10%PE/PB/市值
消息面20%LLM 根据新闻原文判断
情绪面15%LLM 根据市场数据判断

信号等级

STRONG_BUY(>=80) > BUY(>=65) > WATCH(>=50) > HOLD(>=35) > SELL(>=20) > STRONG_SELL(<20)

数据源

市场主源降级链
A股腾讯新浪→东财→同花顺
美股腾讯yfinance
港股腾讯-
商品新浪期货-

规则

  1. 必须使用工具获取数据,禁止凭记忆回答行情
  2. PE>100 或 PB<0.8 时必须标注风险
  3. 涨停>30只时提示市场情绪亢奋
  4. 北向净流出>50亿时提示外资撤离

Comments

Loading comments...