Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Economic Dashboard

v0.3.3

提供全球宏观经济数据仪表板视图,支持多源数据本地存储、冷热数据分离存储与自动化刷新调度。

0· 109·0 current·0 all-time
byTang Weigang@tangweigang-jpg

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for tangweigang-jpg/economic-dashboard.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Economic Dashboard" (tangweigang-jpg/economic-dashboard) from ClawHub.
Skill page: https://clawhub.ai/tangweigang-jpg/economic-dashboard
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install economic-dashboard

ClawHub CLI

Package manager switcher

npx clawhub@latest install economic-dashboard
Security Scan
Capability signals
CryptoCan make purchasesRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description promise a macroeconomic dashboard and local multi-source storage. The package includes end-to-end pipeline elements (data_collection → ... → trading_execution) and use-cases for backtests and trading execution, plus credential setup scripts. Trading/execution and credential-management are plausible for a full quant pipeline but expand the scope beyond a read-only dashboard — this is not strictly disproportional but is broader than a UI-only 'dashboard' expectation.
!
Instruction Scope
SKILL.md and seed.yaml direct the agent to reload seed.yaml, run declared preconditions (python commands that check/import zvt, touch/verify ~/.zvt), and follow an execution protocol that may run host install recipes and precondition scripts. Those runtime instructions can run Python commands, inspect and write to local paths (ZVT_HOME), and invoke credential setup/verification scripts. For an instruction-only skill this grants broad filesystem and runtime activity relative to a simple dashboard and could lead to unintended local actions if followed automatically.
Install Mechanism
No install spec or external downloads are declared (instruction-only), which is lower risk. However seed.yaml's execution_protocol refers to host_adapter.install_recipes[] and pip install zvt in preconditions — these imply installation steps may be suggested at runtime even though none are packaged. That mismatch is worth noting but not an active install risk in the package itself.
!
Credentials
The skill declares no required env vars, yet many references and use-cases involve external APIs (FRED, Yahoo Finance), credential managers, and scripts to 'setup_credentials' or 'verify_api_keys'. The skill expects credential handling but does not declare or require the credentials up front; this omission makes it unclear how secrets will be requested, stored, or used. Additionally, preconditions read/write to ZVT_HOME (~/.zvt) which affects local config and storage but was not explicitly called out in required config fields.
Persistence & Privilege
always:false and no declared modifications to other skills — normal. But the SKILL.md/seed.yaml strongly instruct the agent to re-read and obey seed.yaml and to run host install/precondition actions on execute; while not an elevation of platform privileges, it gives this skill large influence over the agent's runtime behavior if followed without human review.
What to consider before installing
This package is an instruction-only, compiled blueprint for an end-to-end quant/dashboard pipeline that also includes trading and credential-management guidance. Before installing or allowing autonomous runs: 1) Review seed.yaml, SKILL.md, and the scripts referenced (scripts/*) to see exactly what commands will run and how credentials are handled. 2) Expect the agent to run Python checks and read/write under ZVT_HOME (~/.zvt) — run in an isolated environment or container if you are unsure. 3) Do not supply API keys or broker credentials until you verify where and how they are stored (look for encryption, storage paths, and any calls that transmit them). 4) Because the skill includes trading_execution semantics (semantic locks and next-bar execution), treat any automated 'execute' action with caution — confirm whether the skill will actually place orders or only generate code/signals. 5) Ask the publisher for source repo/homepage and a README explaining credential handling and any install recipes; absence of a source/homepage is a red flag. If you need help reviewing specific scripts (e.g., setup_credentials.py or scripts that migrate caches), share them for a focused review.

Like a lobster shell, security has layers — review code before you run it.

datavk97c3gsz50zt89z5hyfmzd551h85cjk9doramagic-crystalvk97c3gsz50zt89z5hyfmzd551h85cjk9financevk97c3gsz50zt89z5hyfmzd551h85cjk9latestvk97c3gsz50zt89z5hyfmzd551h85cjk9
109downloads
0stars
3versions
Updated 5d ago
v0.3.3
MIT-0

宏观经济仪表板 (economic-dashboard)

提供全球宏观经济数据仪表板视图,支持多源数据本地存储、冷热数据分离存储与自动化刷新调度。

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (13 total)

Database Snapshot Optimization (UC-101)

Creates optimized database backups by partitioning hot (<90 days) and cold (>90 days) data into appropriate storage formats with ZSTD compression and Triggers: backup, snapshot, parquet

Database Compaction and Optimization (UC-102)

Optimizes database performance by running VACUUM, rebuilding indexes, and deduplicating records within retention windows while measuring compression s Triggers: vacuum, optimize, database cleanup

Daily Economic Data Refresh (UC-104)

Fetches each economic data from FRED and Yahoo Finance APIs daily and stores results in cache for dashboard consumption Triggers: refresh data, daily update, FRED data

For all 13 use cases, see references/USE_CASES.md.

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

  • Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
  • Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
  • Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
  • Time range: start_timestamp and end_timestamp for backtest period
  • Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

IDRuleOn Violation
SL-01Execute sell orders before buy orders in every trading cyclehalt
SL-02Trading signals MUST use next-bar execution (no look-ahead)halt
SL-03Entity IDs MUST follow format entity_type_exchange_codehalt
SL-04DataFrame index MUST be MultiIndex (entity_id, timestamp)halt
SL-05TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amounthalt
SL-06filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTIONhalt
SL-07Transformer MUST run BEFORE Accumulator in factor pipelinehalt
SL-08MACD parameters locked: fast=12, slow=26, signal=9halt

Full lock definitions: references/LOCKS.md

Top Anti-Patterns (14 total)

  • AP-MACRO-DATA-001: SEC EDGAR Rate Limit Violation
  • AP-MACRO-DATA-002: Temporal Knowledge Graph Look-Ahead Bias
  • AP-MACRO-DATA-003: Technical Indicator Look-Ahead Bias via Missing Shift

All 14 anti-patterns: references/ANTI_PATTERNS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-083. Evidence verify ratio = 28.0% and audit fail total = 33. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

FileContentsWhen to Load
references/seed.yamlV6+ 全量权威 (source-of-truth)有行为/决策争议时必读
references/ANTI_PATTERNS.md14 条跨项目反模式开始实现前
references/WISDOM.md跨项目精华借鉴架构决策时
references/CONSTRAINTS.mddomain + fatal 约束规则冲突时
references/USE_CASES.md全量 KUC-* 业务场景需要完整示例时
references/LOCKS.mdSL-* + preconditions + hints生成回测/交易代码前
references/COMPONENTS.mdAST 组件地图(按 module 拆分)查 API 时

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-083 blueprint at 2026-04-22T13:00:33.402010+00:00. See human_summary.md for non-technical overview.

Comments

Loading comments...