Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Quant Trading CN
v1.0.0量化交易专家 - 基于印度股市实战经验，支持策略生成、回测、实盘交易（Zerodha/A股适配）
⭐ 1· 3.7k·35 current·39 all-time
byGuohongbin@guohongbin-git
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
Name/description promise: generate strategies, backtest, and run live trading (Zerodha/A-share). Declared requirements: only 'python3', no env vars or credentials. SKILL.md and README instruct how to run a wizard, fetch universes, and — critically — create a .env with KITE_API_KEY/KITE_API_SECRET/KITE_ACCESS_TOKEN for live trading. The metadata omits these sensitive env vars, and the skill bundle does not include the runtime scripts it tells you to run. Asking for Zerodha credentials is coherent with live-trading functionality, but the omission in requires.env and the absence of the referenced scripts in the package are inconsistent and suspicious.
Instruction Scope
The SKILL.md tells the agent/user to run ./scripts/wizard.sh which 'scans current directory for trading code', run check-code to analyze and optionally modify user code, fetch live index constituents from NSE, and to create/use .env files containing API keys. These instructions therefore: (a) require access to local files and may modify user code if the wizard applies fixes; (b) request and use sensitive API credentials for live trading; and (c) instruct network operations (NSE, Kite API). None of this is declared in the skill metadata. The instructions also reference scripts and files (scripts/) that are not included in the packaged files, so following them as-is would either fail or pull external code first — a potentially risky step.
Install Mechanism
The skill is instruction-only (no install spec), which is low-risk by itself. However the README/SKILL.md explicitly recommend cloning an external GitHub repo (javajack/skill-algotrader), running start.sh, creating a venv, and pip installing requirements.txt. Those recommended steps would download and run arbitrary external code not vetted here. The package as published does not include the scripts it references, so the user would likely be directed to fetch remote code before the advertised functionality works — this raises moderate risk.
Credentials
Declared required env vars: none. But instructions show the skill expects Zerodha credentials (KITE_API_KEY, KITE_API_SECRET, KITE_ACCESS_TOKEN) and advises creating a .env with those secrets. That is a direct mismatch: the skill will need sensitive keys for live trading, yet does not declare them as required. The skill asks to access the user's filesystem (scanning directories) and to possibly store credentials in a .env file. Requesting or handling live-trading API keys is reasonable for live execution, but failing to declare this in metadata is an important discrepancy for security review.
Persistence & Privilege
The skill does not request 'always: true' nor bundle executable code that would be installed persistently. It is instruction-only, so on its face it does not gain permanent platform privileges. However the runtime instructions encourage cloning and running an external repository and running scripts that can modify user files (the wizard claims it can 'apply fixes automatically'), which means following the skill's guidance could result in arbitrary changes to the user's workspace. This is an operational risk but not a declared persistence privilege in the skill manifest.
What to consider before installing
This skill looks like a genuine trading guide but has important mismatches and missing pieces. Before installing or running anything: 1) Do not paste your Zerodha/API secrets into chat — the skill did not declare them in metadata even though its README instructs creating a .env with KITE_API_KEY/KITE_API_SECRET/KITE_ACCESS_TOKEN. 2) The SKILL.md references ./scripts/*.sh and other files that are not present in the packaged bundle; the README suggests cloning an external GitHub repo — review that repo and its scripts manually before running them. 3) If you plan to use live trading, use a paper trading or limited-permission API key, rotate keys after testing, and never reuse production credentials. 4) Expect the wizard to scan and potentially modify files in your current directory; back up your code first and run the tool in an isolated environment (container or VM). 5) If you want to proceed, ask the publisher for clarity (origin, full repo, and which scripts are missing) and inspect requirements.txt/start.sh and any scripts for network calls, telemetry, or unexpected behavior before executing. Given the metadata/instruction discrepancies, avoid running any automatically-applied fixes or start scripts until you verify the external code.Like a lobster shell, security has layers — review code before you run it.
financevk97d7c1h939e34hzj6jcw236vh81e719latestvk97d7c1h939e34hzj6jcw236vh81e719quantvk97d7c1h939e34hzj6jcw236vh81e719tradingvk97d7c1h939e34hzj6jcw236vh81e719
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📈 Clawdis
Binspython3