Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Darts Forecasting

v0.3.3

Darts 是轻量级时间序列预测库,支持多市场金融数据的确定性与概率性预测,提供协变量整合与层级聚合能力。

0· 103·0 current·0 all-time
byTang Weigang@tangweigang-jpg

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for tangweigang-jpg/darts-forecasting.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Darts Forecasting" (tangweigang-jpg/darts-forecasting) from ClawHub.
Skill page: https://clawhub.ai/tangweigang-jpg/darts-forecasting
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install darts-forecasting

ClawHub CLI

Package manager switcher

npx clawhub@latest install darts-forecasting
Security Scan
Capability signals
Crypto
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
Name/description match a forecasting helper, and most content is forecasting-focused, but the SKILL.md repeatedly references zvt, ZVT_HOME, Python 3.12+, and a host-specific 'uv' package manager while the registry metadata declares no dependencies, binaries, or env vars. The skill expects a specific host ecosystem (Doramagic) and other tooling (zvt) that are not surfaced as required capabilities — this mismatch is disproportionate to the claimed simple 'Darts' purpose.
!
Instruction Scope
Runtime instructions direct the agent to run Python precondition checks (import zvt, run zvt.recorders), to pip-install packages if missing, to touch/write files under ZVT_HOME (~/.zvt), and to reload seed.yaml before decisions. These are active host-side operations (filesystem writes, package installs, network fetches) beyond a passive documentation skill. The SKILL.md also contains 'semantic locks' and execution protocols that give the agent broad behavioral rules to enforce (e.g., halting on violations) — all of which expands runtime scope significantly.
Install Mechanism
There is no declared install spec (instruction-only), which is low-risk in itself, but the instructions tell the agent to run pip installs (e.g., pip install zvt) and depend on Python 3.12+ with a specific package manager. Because installs would occur at runtime and are not declared, this increases operational risk and surprises the user — the skill should declare required packages or provide an explicit, vetted install mechanism.
!
Credentials
The skill declares no required env vars but its preconditions reference ZVT_HOME and require writable user directories; the skill also asks the user which data provider to use (eastmoney, joinquant, qmt) — some options require credentials — yet no credential/env requirements are declared. Access to ~/.zvt, ability to install packages, and potential use of broker/provider credentials are disproportionate to the metadata's 'no env vars' claim.
Persistence & Privilege
always:false (normal). The instructions do request creating/writing to user data directories (~/.zvt) and running package installs; however the skill does not request permanent platform-level privileges or modify other skills. Still, runtime writes and installs are privileged operations on the host and should be disclosed/explicitly authorized by the user.
What to consider before installing
This skill is instruction-only but tells the agent to run Python checks, pip-install packages (e.g., zvt), create/write to ~/.zvt, and call recorders that fetch external market data. Those actions can modify your filesystem and install software and may prompt you for provider/broker credentials later — yet the skill metadata does not declare these requirements. Before installing or running: 1) Treat it as code that will execute commands on your machine; run it in a sandbox/VM or isolated environment. 2) Ask the author to declare required Python version, packages, and any env vars/credentials (ZVT_HOME, broker API keys). 3) If you must run it on your host, review seed.yaml and SKILL.md in full and confirm you consent to pip installs and directory writes. 4) If you plan to connect broker/data providers, supply credentials only after verifying the integration and preferably via secure secret storage — do not paste secrets directly into a chat. 5) If you want a safer alternative, request a read-only walkthrough (code generation only) rather than executing precondition or recorder commands automatically.

Like a lobster shell, security has layers — review code before you run it.

datavk97djdb52r5pn0gwskyghsbcbh85da11doramagic-crystalvk97djdb52r5pn0gwskyghsbcbh85da11financevk97djdb52r5pn0gwskyghsbcbh85da11latestvk97djdb52r5pn0gwskyghsbcbh85da11
103downloads
0stars
3versions
Updated 5d ago
v0.3.3
MIT-0

Darts 时序预测 (darts-forecasting)

Darts 是轻量级时间序列预测库,支持多市场金融数据的确定性与概率性预测,提供协变量整合与层级聚合能力。

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (31 total)

Sphinx Package Title Fixer (UC-101)

Automates extraction of descriptive titles and docstrings from Python packages to improve Sphinx API documentation readability Triggers: sphinx documentation, package titles, docstring extraction

Sphinx Documentation Configuration (UC-102)

Configures Sphinx documentation builder with extensions for auto-summary, autodoc, and graphviz visualization Triggers: sphinx config, documentation, autodoc

Example Utilities Module (UC-131)

Provides utility functions for managing Python paths when running Darts examples locally Triggers: utilities, path management, example helpers

For all 31 use cases, see references/USE_CASES.md.

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

  • Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
  • Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
  • Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
  • Time range: start_timestamp and end_timestamp for backtest period
  • Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

IDRuleOn Violation
SL-01Execute sell orders before buy orders in every trading cyclehalt
SL-02Trading signals MUST use next-bar execution (no look-ahead)halt
SL-03Entity IDs MUST follow format entity_type_exchange_codehalt
SL-04DataFrame index MUST be MultiIndex (entity_id, timestamp)halt
SL-05TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amounthalt
SL-06filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTIONhalt
SL-07Transformer MUST run BEFORE Accumulator in factor pipelinehalt
SL-08MACD parameters locked: fast=12, slow=26, signal=9halt

Full lock definitions: references/LOCKS.md

Top Anti-Patterns (15 total)

  • AP-TIME-SERIES-ML-001: TimeSeries values array dimensionality mismatch
  • AP-TIME-SERIES-ML-002: Non-floating-point dtype in TimeSeries values
  • AP-TIME-SERIES-ML-003: Irregular or non-monotonic time index

All 15 anti-patterns: references/ANTI_PATTERNS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-102. Evidence verify ratio = 43.8% and audit fail total = 26. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

FileContentsWhen to Load
references/seed.yamlV6+ 全量权威 (source-of-truth)有行为/决策争议时必读
references/ANTI_PATTERNS.md15 条跨项目反模式开始实现前
references/WISDOM.md跨项目精华借鉴架构决策时
references/CONSTRAINTS.mddomain + fatal 约束规则冲突时
references/USE_CASES.md全量 KUC-* 业务场景需要完整示例时
references/LOCKS.mdSL-* + preconditions + hints生成回测/交易代码前
references/COMPONENTS.mdAST 组件地图(按 module 拆分)查 API 时

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-102 blueprint at 2026-04-22T13:00:47.497902+00:00. See human_summary.md for non-technical overview.

Comments

Loading comments...