Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Czsc Chan Theory

v0.3.3

CZSC 缠论技术分析工具,支持 K 线生成、笔线段识别、分型信号提取与 A 股回测可视化。

0· 87·0 current·0 all-time
byTang Weigang@tangweigang-jpg

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for tangweigang-jpg/czsc-chan-theory.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Czsc Chan Theory" (tangweigang-jpg/czsc-chan-theory) from ClawHub.
Skill page: https://clawhub.ai/tangweigang-jpg/czsc-chan-theory
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install czsc-chan-theory

ClawHub CLI

Package manager switcher

npx clawhub@latest install czsc-chan-theory
Security Scan
Capability signals
CryptoRequires OAuth tokenRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The name/description describe a CZSC chan-theory backtesting/analysis tool for A‑share (uses ZVT/ZVT-style pipeline). However the package metadata declares no required binaries/env vars/install steps while SKILL.md explicitly states compatibility requirements (Python 3.12+ and 'uv' package manager) and the seed.yaml execution_protocol expects verifying/installing Python packages (e.g., zvt). This mismatch between declared requirements and the runtime instructions is an incoherence that could surprise users (the skill will assume Python/ZVT presence though the registry metadata doesn't require them).
Instruction Scope
SKILL.md and seed.yaml include explicit runtime preconditions that run python -c checks, may prompt pip installs (PC-01), and read/write under a ZVT home directory (pc checks touch ~/.zvt). Those actions are reasonable for a backtest tool, but they let the agent run arbitrary Python commands and create files in the user's home. The instructions also require re-reading the large seed.yaml and other reference files before behavior—this gives the skill broad discretion to inspect workspace files. No instructions request secrets or remote exfil endpoints.
Install Mechanism
This is an instruction-only skill with no install spec or downloaded code; nothing will be written by an automated install step. That lowers risk. However the SKILL.md expects the host/agent to perform package verification and may direct the user/agent to run pip install for dependencies (e.g., zvt) at runtime.
Credentials
The skill declares no required environment variables, no credentials, and no config paths. The runtime preconditions reference ZVT_HOME (a common config path) and will check/read/write ~/.zvt if present; this is proportional for a backtesting tool but should be noted since the skill may create or modify that directory.
Persistence & Privilege
always:false and default autonomous invocation are set (normal). The seed.yaml execution_protocol instructs agents to re-read seed.yaml and to run preconditions before executing behavior; this does not force permanent installation of the skill but does give it an operational requirement before actions. There is no explicit request to modify other skills or global agent settings in the provided files.
What to consider before installing
This skill appears to be a CZSC/ZVT backtesting documentation bundle rather than packaged code. Key things to consider before installing or running it: - Inconsistency: SKILL.md requires Python 3.12+ and an 'uv' package manager and references zvt, but the registry metadata lists no required binaries or install steps. Expect to manually install Python packages (e.g., zvt) in your environment. - Runtime actions: The skill's preconditions include python -c checks and may prompt pip install commands and touch ~/.zvt. Run these commands in a controlled environment (virtualenv/container) rather than your primary workstation. - No credentials requested: The skill does not ask for API keys or secrets, reducing exfil risk, but it can read/write local files and run Python commands—treat accordingly. - Licensing/source: The skill lists a Proprietary license and no homepage/source URL; lack of upstream provenance increases risk. Prefer code from known repositories or request an explicit install/spec that lists exact dependencies. - Recommendation: If you want to use it, run in an isolated environment, inspect seed.yaml and the referenced files yourself, and avoid running any suggested pip installs or scripts until you validate the packages and versions. If possible, ask the publisher for an explicit dependency/install manifest (requirements.txt / lock file) and a source/homepage.

Like a lobster shell, security has layers — review code before you run it.

a-sharevk97c8g2g1yap95xzr1zbzcd0a585dqymdatavk97c8g2g1yap95xzr1zbzcd0a585dqymdoramagic-crystalvk97c8g2g1yap95xzr1zbzcd0a585dqymfinancevk97c8g2g1yap95xzr1zbzcd0a585dqymlatestvk97c8g2g1yap95xzr1zbzcd0a585dqymquantvk97c8g2g1yap95xzr1zbzcd0a585dqym
87downloads
0stars
3versions
Updated 4d ago
v0.3.3
MIT-0

缠论技术分析 (czsc-chan-theory)

CZSC 缠论技术分析工具,支持 K 线生成、笔线段识别、分型信号提取与 A 股回测可视化。

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (10 total)

Sphinx Documentation Configuration (UC-101)

Configuring Sphinx documentation builder for the czsc project, ensuring proper Python path setup and Rust version priority Triggers: documentation, sphinx, configuration

CZSC Performance Benchmarking (UC-102)

Benchmarking CZSC analysis performance with varying K-line counts to measure initialization speed and memory usage Triggers: benchmark, performance, speed

Volatility Classification Signal (UC-104)

Classifying market volatility into three tiers (low/middle/high) based on recent K-line price ranges for signal generation Triggers: volatility, classification, signal

For all 10 use cases, see references/USE_CASES.md.

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

  • Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
  • Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
  • Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
  • Time range: start_timestamp and end_timestamp for backtest period
  • Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

IDRuleOn Violation
SL-01Execute sell orders before buy orders in every trading cyclehalt
SL-02Trading signals MUST use next-bar execution (no look-ahead)halt
SL-03Entity IDs MUST follow format entity_type_exchange_codehalt
SL-04DataFrame index MUST be MultiIndex (entity_id, timestamp)halt
SL-05TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amounthalt
SL-06filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTIONhalt
SL-07Transformer MUST run BEFORE Accumulator in factor pipelinehalt
SL-08MACD parameters locked: fast=12, slow=26, signal=9halt

Full lock definitions: references/LOCKS.md

Top Anti-Patterns (25 total)

  • AP-ZVT-183: 除权因子为 inf/NaN 时直接参与乘法导致复权静默失败
  • AP-ZVT-179: 第三方数据接口超限后异常被吞噬,数据静默缺失
  • AP-ZVT-183B: HFQ(后复权)与 QFQ(前复权)K 线表使用错误导致因子计算漂移

All 25 anti-patterns: references/ANTI_PATTERNS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-091. Evidence verify ratio = 60.4% and audit fail total = 13. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

FileContentsWhen to Load
references/seed.yamlV6+ 全量权威 (source-of-truth)有行为/决策争议时必读
references/ANTI_PATTERNS.md25 条跨项目反模式开始实现前
references/WISDOM.md跨项目精华借鉴架构决策时
references/CONSTRAINTS.mddomain + fatal 约束规则冲突时
references/USE_CASES.md全量 KUC-* 业务场景需要完整示例时
references/LOCKS.mdSL-* + preconditions + hints生成回测/交易代码前
references/COMPONENTS.mdAST 组件地图(按 module 拆分)查 API 时

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-091 blueprint at 2026-04-22T13:00:38.716020+00:00. See human_summary.md for non-technical overview.

Comments

Loading comments...