Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Ifrs9 Loss Engine

v0.3.3

计算IFRS 9预期信用损失(ECL),支持Vasicek单因子前瞻性调整、Kaplan-Meier生存分析计算PD及贷款摊销计划生成,满足Basel III减值合规要求。

0· 106·0 current·0 all-time
byTang Weigang@tangweigang-jpg

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for tangweigang-jpg/ifrs9-loss-engine.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Ifrs9 Loss Engine" (tangweigang-jpg/ifrs9-loss-engine) from ClawHub.
Skill page: https://clawhub.ai/tangweigang-jpg/ifrs9-loss-engine
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install ifrs9-loss-engine

ClawHub CLI

Package manager switcher

npx clawhub@latest install ifrs9-loss-engine
Security Scan
Capability signals
CryptoCan make purchasesRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The name/description state IFRS 9 ECL/regtech compliance, but the SKILL.md and human_summary repeatedly reference quant trading, ZVT backtests, data recorders, and a pipeline that includes 'trading_execution' and MACD-based use cases. That combination (regulatory provisioning + active trading/backtesting orchestration) is internally inconsistent: an IFRS9 provisioning engine should not need trading-execution semantics or locked MACD trading parameters. This looks like either mixing two different blueprints or an over-broad scope.
!
Instruction Scope
Runtime instructions require re-reading seed.yaml, enforcing many fatal 'semantic locks' (e.g., order of sell/buy execution, next-bar execution) and running precondition python commands that check/import zvt, check writable directories, and possibly run recorders. Those steps can cause the agent to execute host commands, interact with data providers, or prepare to execute trades. The SKILL.md effectively grants the agent discretion to run environment checks and pipeline actions beyond a narrow ECL calculation, which is scope creep relative to the stated purpose.
Install Mechanism
No install spec is provided (instruction-only), which is low risk from an installation download standpoint. However SKILL.md declares a runtime requirement (Python 3.12+ and the 'uv' package manager) but does not supply an install recipe. The missing install spec is a practical inconsistency—users/hosts will be asked to meet runtime dependencies with no guidance.
!
Credentials
The skill declares no required environment variables or credentials, yet the text asks about data sources (joinquant, qmt/broker, eastmoney) and references recorders and trading execution. Those data providers and brokers normally require API keys/credentials. The absence of declared env vars is an incoherence: either the skill will prompt for or attempt to use secrets at runtime, or callers will need to supply credentials ad-hoc. This mismatch increases risk because credential access is not made explicit or constrained.
Persistence & Privilege
The skill does not request 'always: true' and is user-invocable only. There is no install spec that would write arbitrary binaries to disk, and no declared behavior that it will persistently modify other skills or system-wide settings. Persistence/privilege requests appear proportionate.
What to consider before installing
This skill contains mixed signals: it claims to be an IFRS 9 ECL engine but also embeds quant-trading/backtest semantics and host-level preconditions. Before installing or running it: 1) Ask the author to clarify scope — is this purely an IFRS9/regtech model or also a trading/backtest toolkit? 2) Request an explicit install spec (how to install Python/uv deps) and a list of exact environment variables/credentials the skill will need (and where/how they'll be used). 3) If you plan to run it, do so in an isolated environment (sandbox/container) and inspect seed.yaml and referenced scripts first. 4) Ensure the skill cannot autonomously execute trades or access broker APIs without explicit, auditable user approval — semantic locks implying order execution are a red flag. 5) If you require regulatory-grade results, validate outputs against trusted implementations and review the referenced anti-patterns and preconditions (seed.yaml) for correctness. Refuse to provide credentials until the skill author explains why they are needed and how they are used/stored.

Like a lobster shell, security has layers — review code before you run it.

compliancevk97ebdxb390sqebtdr5kpj398x85daq6creditvk97ebdxb390sqebtdr5kpj398x85daq6doramagic-crystalvk97ebdxb390sqebtdr5kpj398x85daq6financevk97ebdxb390sqebtdr5kpj398x85daq6latestvk97ebdxb390sqebtdr5kpj398x85daq6
106downloads
0stars
3versions
Updated 4d ago
v0.3.3
MIT-0

IFRS 9 损失引擎 (ifrs9-loss-engine)

计算IFRS 9预期信用损失(ECL),支持Vasicek单因子前瞻性调整、Kaplan-Meier生存分析计算PD及贷款摊销计划生成,满足Basel III减值合规要求。

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (42 total)

ECL Limit Level Truncation Analysis (UC-101)

Calculates Expected Credit Loss (ECL) at the limit/tranche level by computing remaining tenor and projecting loan balances with interest, supporting I Triggers: ECL, Expected Credit Loss, limit level

Loan Amortization Schedule Calculator (UC-102)

Computes loan amortization schedules by iteratively calculating interest amounts and remaining balances after each payment, determining total repaymen Triggers: amortization, loan, payment schedule

Amortization Schedule with NumPy Financial (UC-103)

Generates amortization schedules using numpy-financial library functions (PMT, PPMT, IPMT) for calculating periodic payments, principal, and interest Triggers: amortization, numpy-financial, PMT

For all 42 use cases, see references/USE_CASES.md.

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

  • Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
  • Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
  • Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
  • Time range: start_timestamp and end_timestamp for backtest period
  • Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

IDRuleOn Violation
SL-01Execute sell orders before buy orders in every trading cyclehalt
SL-02Trading signals MUST use next-bar execution (no look-ahead)halt
SL-03Entity IDs MUST follow format entity_type_exchange_codehalt
SL-04DataFrame index MUST be MultiIndex (entity_id, timestamp)halt
SL-05TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amounthalt
SL-06filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTIONhalt
SL-07Transformer MUST run BEFORE Accumulator in factor pipelinehalt
SL-08MACD parameters locked: fast=12, slow=26, signal=9halt

Full lock definitions: references/LOCKS.md

Top Anti-Patterns (15 total)

  • AP-REGTECH-001: Missing attribute initialization on data structures
  • AP-REGTECH-002: Self-loops in transaction graphs violate domain rules
  • AP-REGTECH-003: Unvalidated floating-point inputs cause runtime crashes

All 15 anti-patterns: references/ANTI_PATTERNS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-062. Evidence verify ratio = 80.0% and audit fail total = 15. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

FileContentsWhen to Load
references/seed.yamlV6+ 全量权威 (source-of-truth)有行为/决策争议时必读
references/ANTI_PATTERNS.md15 条跨项目反模式开始实现前
references/WISDOM.md跨项目精华借鉴架构决策时
references/CONSTRAINTS.mddomain + fatal 约束规则冲突时
references/USE_CASES.md全量 KUC-* 业务场景需要完整示例时
references/LOCKS.mdSL-* + preconditions + hints生成回测/交易代码前
references/COMPONENTS.mdAST 组件地图(按 module 拆分)查 API 时

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-062 blueprint at 2026-04-22T13:00:19.657886+00:00. See human_summary.md for non-technical overview.

Comments

Loading comments...