Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Easytrader Cn Broker

v0.3.3

提供A股券商客户端自动化交易能力,支持雪球、芸享等多券商登录与交易操作封装,涵盖账户余额查询、持仓管理、委托下单及组合跟随等核心功能。

0· 91·0 current·0 all-time
byTang Weigang@tangweigang-jpg

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for tangweigang-jpg/easytrader-cn-broker.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Easytrader Cn Broker" (tangweigang-jpg/easytrader-cn-broker) from ClawHub.
Skill page: https://clawhub.ai/tangweigang-jpg/easytrader-cn-broker
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install easytrader-cn-broker

ClawHub CLI

Package manager switcher

npx clawhub@latest install easytrader-cn-broker
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md describes live broker login and order execution for A‑share brokers (which normally require account cookies/API keys and network endpoints), but the registry metadata and requires.* fields list no credentials, no config paths, and no required binaries. That mismatch is unexpected for a broker/trading skill.
!
Instruction Scope
Although instruction-only (no code), the SKILL.md and referenced files instruct the agent to run Python precondition checks (import zvt), read/write the ZVT_HOME directory, run tests/servers, and follow an execution_protocol that re-reads seed.yaml and may trigger install actions. These runtime steps reference environment variables and filesystem paths not declared in requires.env and give the agent discretion to execute commands and install packages — scope creep for an instruction-only skill.
Install Mechanism
There is no install spec (lower risk), but the SKILL.md and seed.yaml talk about Python 3.12+, uv package manager, and on-failure pip install steps in preconditions. That implicit expectation (installing Python packages or running host install recipes) is not represented in the metadata and is a mismatch to watch.
!
Credentials
A broker-trading capability should explicitly declare credentials (cookies, API keys, tokens) and any required env vars. This skill declares none, yet the docs/tests mention required cookies and use of ZVT_HOME via os.environ. The missing declared env/credential surface is disproportionate and incoherent.
Persistence & Privilege
always:false (good). The skill allows autonomous invocation (platform default) but does not request permanent presence. However, seed.yaml enforces host-side execution_protocol and precondition steps that may prompt the agent to run installs or filesystem writes; combined with the other mismatches, this increases the operational footprint and should be considered.
What to consider before installing
This skill looks like a broker-trading toolkit but is missing key declarations you should expect before installing. Before you proceed: 1) Ask the author for the source code and an install spec (how packages are installed, what exact commands will run). 2) Require an explicit list of required environment variables and secrets (broker cookies/API keys) and where they are used/stored — do not provide credentials until you confirm secure handling. 3) Run the skill first in an isolated/sandbox environment (no real money accounts, isolated filesystem) and review any pip installs and files written under ~/.zvt. 4) Verify the LICENSE and provenance (homepage/source are unknown). 5) If you need to use it for real trading, insist on an auditable code release that shows secure credential handling and explicit network endpoints; otherwise treat this instruction-only artifact as untrusted. Providing those items (source code, explicit env vars, and an install manifest) would materially reduce my concern.

Like a lobster shell, security has layers — review code before you run it.

a-sharevk97a1rwf5026w0v4hcgx93vy5185cngxdoramagic-crystalvk97a1rwf5026w0v4hcgx93vy5185cngxfinancevk97a1rwf5026w0v4hcgx93vy5185cngxlatestvk97a1rwf5026w0v4hcgx93vy5185cngxportfoliovk97a1rwf5026w0v4hcgx93vy5185cngx
91downloads
0stars
3versions
Updated 4d ago
v0.3.3
MIT-0

A 股券商自动交易 (easytrader-cn-broker)

提供A股券商客户端自动化交易能力,支持雪球、芸享等多券商登录与交易操作封装,涵盖账户余额查询、持仓管理、委托下单及组合跟随等核心功能。

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (4 total)

Broker API Server for Trading Operations (UC-101)

Provides HTTP REST API endpoints for broker authentication and retrieving account balance information programmatically, enabling integration with exte Triggers: server, api, http

XueQiu Trader Account Preparation Validation Test (UC-102)

Unit test that validates XueQiuTrader correctly handles account preparation with required parameters (cookies) and properly stores portfolio configura Triggers: xueqiu, trader, account preparation

YunHui Client Trader Integration Tests (UC-103)

Integration tests for YunHui (yh_client) broker trading operations including balance queries, today's trades/entrusts, and entrust cancellation functi Triggers: yh_client, balance, entrust

For all 4 use cases, see references/USE_CASES.md.

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

  • Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
  • Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
  • Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
  • Time range: start_timestamp and end_timestamp for backtest period
  • Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

IDRuleOn Violation
SL-01Execute sell orders before buy orders in every trading cyclehalt
SL-02Trading signals MUST use next-bar execution (no look-ahead)halt
SL-03Entity IDs MUST follow format entity_type_exchange_codehalt
SL-04DataFrame index MUST be MultiIndex (entity_id, timestamp)halt
SL-05TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amounthalt
SL-06filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTIONhalt
SL-07Transformer MUST run BEFORE Accumulator in factor pipelinehalt
SL-08MACD parameters locked: fast=12, slow=26, signal=9halt

Full lock definitions: references/LOCKS.md

Top Anti-Patterns (25 total)

  • AP-ZVT-183: 除权因子为 inf/NaN 时直接参与乘法导致复权静默失败
  • AP-ZVT-179: 第三方数据接口超限后异常被吞噬,数据静默缺失
  • AP-ZVT-183B: HFQ(后复权)与 QFQ(前复权)K 线表使用错误导致因子计算漂移

All 25 anti-patterns: references/ANTI_PATTERNS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-094. Evidence verify ratio = 62.7% and audit fail total = 8. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

FileContentsWhen to Load
references/seed.yamlV6+ 全量权威 (source-of-truth)有行为/决策争议时必读
references/ANTI_PATTERNS.md25 条跨项目反模式开始实现前
references/WISDOM.md跨项目精华借鉴架构决策时
references/CONSTRAINTS.mddomain + fatal 约束规则冲突时
references/USE_CASES.md全量 KUC-* 业务场景需要完整示例时
references/LOCKS.mdSL-* + preconditions + hints生成回测/交易代码前
references/COMPONENTS.mdAST 组件地图(按 module 拆分)查 API 时

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-094 blueprint at 2026-04-22T13:00:40.820921+00:00. See human_summary.md for non-technical overview.

Comments

Loading comments...