Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Portfolio Optimization

v0.3.3

提供多策略投资组合优化框架,支持均值-方差、Black-Litterman 和分层风险平价(HRP)算法,内置多种协方差估计方法对比分析。

0· 115·0 current·0 all-time
byTang Weigang@tangweigang-jpg

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for tangweigang-jpg/portfolio-optimization.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Portfolio Optimization" (tangweigang-jpg/portfolio-optimization) from ClawHub.
Skill page: https://clawhub.ai/tangweigang-jpg/portfolio-optimization
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install portfolio-optimization

ClawHub CLI

Package manager switcher

npx clawhub@latest install portfolio-optimization
Security Scan
Capability signals
Crypto
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description and the included reference files (components, anti-patterns, use cases) are coherent with a portfolio optimization framework (mean-variance, Black‑Litterman, HRP). References to ZVT, PyPortfolioOpt, covariance methods, and backtest flows fit the stated purpose. Minor mismatch: SKILL.md requires 'Python 3.12+ with uv package manager' and Doramagic-host compatibility but the registry lists no install or runtime constraints — acceptable but worth noting.
!
Instruction Scope
The SKILL.md / seed.yaml execution protocol instructs the agent to: re-read seed.yaml, run precondition checks that execute Python commands (import zvt, call zvt.recorders), run pip install if preconditions fail, initialize data directories, and run data recorders that fetch external market data. Those runtime actions involve filesystem writes, package installation, and network I/O beyond pure local computation. The instructions also reference host_workspace paths and state-machine steps that grant broad discretion to modify the agent host environment. The SKILL.md also references the ZVT_HOME env var (checked in preconditions) but this env var is not declared in the skill metadata.
Install Mechanism
There is no formal install spec (the skill is instruction-only), which reduces static install risk. However, the runtime instructions expect the agent to run pip installs (e.g., install zvt) if preconditions fail. That means installs will occur implicitly at runtime if the preconditions path is followed; relying on ad-hoc pip installs is higher-risk than an explicit vetted install recipe.
!
Credentials
The skill declares no required environment variables, but the runtime preconditions check and use ZVT_HOME and expect library/network access to data providers (eastmoney, joinquant, qmt) which may require credentials. Not declaring ZVT_HOME or any provider credentials is an inconsistency: the agent will read ZVT_HOME and may prompt or attempt to install/configure data access, but the skill metadata does not enumerate these needs.
Persistence & Privilege
always:false and normal autonomous invocation are set (no forced global presence). The skill's execution protocol asks to modify host_workspace paths and to run initialization commands (pip install, zvt.init_dirs), but it does not request explicit persistent privileges or to change other skills' configs. Still, runtime package installation and directory initialization mean it can change the environment if allowed.
What to consider before installing
This skill appears to be a legitimate portfolio-optimization blueprint, but its runtime instructions ask the agent to run environment checks and potentially install packages and write files on your host. Before installing or running it: 1) Inspect references/seed.yaml and SKILL.md yourself to confirm you accept the described execution protocol. 2) Run the skill in an isolated environment (dedicated VM or container) so its pip installs and data recorders cannot affect your main system. 3) Be prepared to supply any data-provider credentials manually; the skill does not declare them but will interact with providers like eastmoney/joinquant and may attempt network fetches. 4) If you don’t want the agent to auto-install packages, deny or review any pip install steps and perform installs manually after vetting package sources (verify zvt package origin and version). 5) Confirm you are comfortable with the semantic locks and fatal preconditions (e.g., next‑bar execution, T+1 rule) because they enforce strict behavior that can halt runs. If you want higher assurance, ask the author for an explicit install recipe, a minimal runtime manifest (declared env vars like ZVT_HOME), and signed package sources before use.

Like a lobster shell, security has layers — review code before you run it.

doramagic-crystalvk97djn6zgha4m8kqy8qq569hyd85d98tfinancevk97djn6zgha4m8kqy8qq569hyd85d98tlatestvk97djn6zgha4m8kqy8qq569hyd85d98tportfoliovk97djn6zgha4m8kqy8qq569hyd85d98tquantvk97djn6zgha4m8kqy8qq569hyd85d98triskvk97djn6zgha4m8kqy8qq569hyd85d98t
115downloads
0stars
3versions
Updated 5d ago
v0.3.3
MIT-0

投资组合优化 (portfolio-optimization)

提供多策略投资组合优化框架,支持均值-方差、Black-Litterman 和分层风险平价(HRP)算法,内置多种协方差估计方法对比分析。

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (6 total)

Risk Model Comparison Analysis (UC-101)

Compares multiple covariance estimation methods (sample, semicovariance, exponential, Ledoit-Wolf variants, oracle approximating) to evaluate which pr Triggers: risk model comparison, covariance estimation methods, portfolio risk analysis

Basic Mean-Variance Optimization (UC-102)

Constructs a minimum volatility portfolio using mean-variance optimization with CAPM-based expected returns and compares sample covariance vs Ledoit-W Triggers: mean-variance optimization, minimum volatility portfolio, Efficient Frontier

Mean-Variance Optimization with Transaction Costs (UC-103)

Implements advanced mean-variance optimization that accounts for broker transaction costs when rebalancing from an initial portfolio allocation, using Triggers: transaction cost optimization, portfolio rebalancing, semicovariance risk

For all 6 use cases, see references/USE_CASES.md.

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

  • Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
  • Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
  • Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
  • Time range: start_timestamp and end_timestamp for backtest period
  • Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

IDRuleOn Violation
SL-01Execute sell orders before buy orders in every trading cyclehalt
SL-02Trading signals MUST use next-bar execution (no look-ahead)halt
SL-03Entity IDs MUST follow format entity_type_exchange_codehalt
SL-04DataFrame index MUST be MultiIndex (entity_id, timestamp)halt
SL-05TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amounthalt
SL-06filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTIONhalt
SL-07Transformer MUST run BEFORE Accumulator in factor pipelinehalt
SL-08MACD parameters locked: fast=12, slow=26, signal=9halt

Full lock definitions: references/LOCKS.md

Top Anti-Patterns (14 total)

  • AP-PORTFOLIO-ANALYTICS-001: Division by zero in price ratio calculations corrupts rebalancing
  • AP-PORTFOLIO-ANALYTICS-002: Look-ahead bias from unshifted signal generation and position calculations
  • AP-PORTFOLIO-ANALYTICS-003: Non-positive-semidefinite covariance matrix breaks CVXPY optimization

All 14 anti-patterns: references/ANTI_PATTERNS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-093. Evidence verify ratio = 34.6% and audit fail total = 40. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

FileContentsWhen to Load
references/seed.yamlV6+ 全量权威 (source-of-truth)有行为/决策争议时必读
references/ANTI_PATTERNS.md14 条跨项目反模式开始实现前
references/WISDOM.md跨项目精华借鉴架构决策时
references/CONSTRAINTS.mddomain + fatal 约束规则冲突时
references/USE_CASES.md全量 KUC-* 业务场景需要完整示例时
references/LOCKS.mdSL-* + preconditions + hints生成回测/交易代码前
references/COMPONENTS.mdAST 组件地图(按 module 拆分)查 API 时

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-093 blueprint at 2026-04-22T13:00:40.212744+00:00. See human_summary.md for non-technical overview.

Comments

Loading comments...