Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

P2p Lending Data

v0.3.3

验证 Frappe Lending 贷款模块核心流程,包括贷款申请创建、放款计划生成、还款处理及结清退款的自动化测试能力。

0· 96·0 current·0 all-time
byTang Weigang@tangweigang-jpg

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for tangweigang-jpg/p2p-lending-data.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "P2p Lending Data" (tangweigang-jpg/p2p-lending-data) from ClawHub.
Skill page: https://clawhub.ai/tangweigang-jpg/p2p-lending-data
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install p2p-lending-data

ClawHub CLI

Package manager switcher

npx clawhub@latest install p2p-lending-data
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill name/description claim the goal is validating Frappe Lending loan flows, but large portions of SKILL.md and human_summary refer to ZVT quant backtesting, markets, data recorders (eastmoney/joinquant/akshare), trading pipelines and semantic locks for trading. Metadata also advertises compatibility with Doramagic host and Python 3.12+ with 'uv' package manager. The registry requirements list no binaries/env/configs, which contradicts the SKILL.md preconditions that require Python packages (zvt) and data directories. These cross-domain and metadata contradictions are disproportionate and unclear.
!
Instruction Scope
The SKILL.md runtime instructions require re-reading seed.yaml, consulting many local reference files, and enforcing semantic locks (trading rules). Preconditions reference running python commands to check for zvt and data directories and instruct the agent to run recorders and installers. That expands the agent's runtime actions beyond simple lending-test descriptions — it instructs the agent to execute environment checks, run recorders, and follow trading/backtest execution triggers. The instructions are prescriptive and mix unrelated file-read and execution steps (lending tests vs market backtests).
Install Mechanism
There is no install spec (instruction-only), which reduces risk of arbitrary code downloads. However the seed.yaml/execution_protocol claims install_trigger steps (resources.host_adapter.install_recipes[]) that are not present in the registry install metadata, creating an inconsistency: the skill expects installation actions but provides no install recipe.
Credentials
The skill declares no required env vars, binaries, or config paths in the registry, yet SKILL.md and seed.yaml expect Python (3.12+), a 'uv' package manager, and the zvt Python package and ZVT_HOME data directories. That mismatch means the skill will attempt actions (import zvt, check ZVT_HOME, run recorders) without declaring the required environment; it's disproportionate and confusing but not explicitly requesting secrets or external credentials.
Persistence & Privilege
always is false and there is no install script included, so the skill does not request permanent automatic inclusion or declared privileged persistence. Autonomous invocation is allowed (default) but not combined with 'always:true' or broad credential requests.
What to consider before installing
This skill is internally inconsistent: its name/description say it's for Frappe Lending tests, but many instructions, preconditions and the human summary talk about ZVT quant backtests, data recorders and trading semantic locks. Before installing or using it, ask the publisher: 1) Which domain is this for (lending tests or ZVT trading/backtest)? 2) Provide a clear, minimal list of required binaries/env vars (Python version, zvt, ZVT_HOME, any recorder credentials) and an explicit install recipe if the skill needs to install packages. 3) Confirm whether the skill will run Python commands/recorders on your host and whether it will write to ~/.zvt or other directories. 4) If you only want lending test automation, request a trimmed SKILL.md that removes ZVT/backtest triggers and semantic locks. Because of the ambiguity, avoid granting broad runtime privileges or running it unattended until the author clarifies these inconsistencies.

Like a lobster shell, security has layers — review code before you run it.

datavk97ektn0bcr6mg776zen2wrxyx85c2abdoramagic-crystalvk97ektn0bcr6mg776zen2wrxyx85c2abfinancevk97ektn0bcr6mg776zen2wrxyx85c2ablatestvk97ektn0bcr6mg776zen2wrxyx85c2ab
96downloads
0stars
3versions
Updated 4d ago
v0.3.3
MIT-0

P2P 贷款测试 (p2p-lending-data)

验证 Frappe Lending 贷款模块核心流程,包括贷款申请创建、放款计划生成、还款处理及结清退款的自动化测试能力。

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (18 total)

Test Infrastructure Setup for Lending Module (UC-101)

Provides shared test utilities and setup functions needed by each lending module tests, including master initialization, loan product creation, and cu Triggers: test setup, lending test utils, test infrastructure

Loan Refund and Closure Testing (UC-102)

Tests the loan closure process when a borrower requests a refund of excess amounts after repaying the loan Triggers: loan refund, loan closure, excess amount refund

Loan Application Creation Testing (UC-103)

Tests the creation and processing of loan applications including rate of interest configuration and applicant details Triggers: loan application, loan request, apply for loan

For all 18 use cases, see references/USE_CASES.md.

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

  • Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
  • Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
  • Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
  • Time range: start_timestamp and end_timestamp for backtest period
  • Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

IDRuleOn Violation
SL-01Execute sell orders before buy orders in every trading cyclehalt
SL-02Trading signals MUST use next-bar execution (no look-ahead)halt
SL-03Entity IDs MUST follow format entity_type_exchange_codehalt
SL-04DataFrame index MUST be MultiIndex (entity_id, timestamp)halt
SL-05TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amounthalt
SL-06filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTIONhalt
SL-07Transformer MUST run BEFORE Accumulator in factor pipelinehalt
SL-08MACD parameters locked: fast=12, slow=26, signal=9halt

Full lock definitions: references/LOCKS.md

Top Anti-Patterns (14 total)

  • AP-CREDIT-RISK-001: Empty DataFrame passed to bucketing pipeline
  • AP-CREDIT-RISK-002: Multi-dimensional target array causing WoE shape mismatch
  • AP-CREDIT-RISK-003: OptimalBucketer receiving high-cardinality numerical features

All 14 anti-patterns: references/ANTI_PATTERNS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-072. Evidence verify ratio = 69.5% and audit fail total = 24. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

FileContentsWhen to Load
references/seed.yamlV6+ 全量权威 (source-of-truth)有行为/决策争议时必读
references/ANTI_PATTERNS.md14 条跨项目反模式开始实现前
references/WISDOM.md跨项目精华借鉴架构决策时
references/CONSTRAINTS.mddomain + fatal 约束规则冲突时
references/USE_CASES.md全量 KUC-* 业务场景需要完整示例时
references/LOCKS.mdSL-* + preconditions + hints生成回测/交易代码前
references/COMPONENTS.mdAST 组件地图(按 module 拆分)查 API 时

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-072 blueprint at 2026-04-22T13:00:26.108289+00:00. See human_summary.md for non-technical overview.

Comments

Loading comments...