Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Quantics Bank

v0.1.1

宽数题库项目入口,涵盖五套量化题库来源、仓库结构、常用命令、公式渲染约束与当前公网部署信息。

0· 66·0 current·0 all-time
byMason@aznikline

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for aznikline/quantics-bank.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Quantics Bank" (aznikline/quantics-bank) from ClawHub.
Skill page: https://clawhub.ai/aznikline/quantics-bank
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install quantics-bank

ClawHub CLI

Package manager switcher

npx clawhub@latest install quantics-bank
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (a repo entrypoint for the Quantics-Bank project) aligns with the SKILL.md content: it documents sources, file layout, and common commands. However, the skill metadata declares no required binaries or environment variables while the instructions clearly assume a Node/npm environment and Vercel usage (npx vercel), plus network access to multiple upstream sites. The capability requested (interacting with the project) reasonably requires those tools/credentials, but they are not declared.
Instruction Scope
SKILL.md stays on-topic: it documents commands to inspect, fetch, build, and deploy the project and points to specific paths and scripts. It does instruct running npm scripts and npx vercel commands which will execute local scripts and may perform network operations (fetching upstream question sources and deploying to Vercel). It does not instruct the agent to read unrelated system files, but it implicitly requires access to the repository contents and network I/O.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing is written to disk by the skill itself. That minimizes install-time risk; the runtime actions are left to the agent or user environment.
!
Credentials
The skill declares no required environment variables or credentials but the instructions expect use of tools that typically rely on credentials: Vercel (npx vercel deploy/whoami) and possibly GitHub access and network fetches to third-party sites. The absence of declared primaryEnv or required env vars makes it unclear what credentials the agent would need or attempt to use; this is a proportionality/visibility problem.
Persistence & Privilege
The skill is not marked always:true and is user-invocable with normal model invocation allowed. It does not request system-wide persistence or modify other skills' configs. Nothing in the metadata indicates elevated or permanent privileges.
What to consider before installing
This skill is mainly documentation for a specific repo and instructs running npm scripts and npx vercel deploys. Before installing or letting an agent run it: (1) verify you have Node/npm and npx/vercel installed and expect the agent to need them; (2) inspect the repository and the scripts/ folder locally—npm scripts can run arbitrary commands; (3) ensure any Vercel or GitHub credentials are only provided intentionally (the skill metadata does not declare them); (4) if an automated agent will run these commands, run them first in a sandbox or local dev environment so you can review network calls and outputs; and (5) be cautious about running data-fetch scripts that contact third-party sites—review those scripts for unwanted exfiltration or unexpected behavior.

Like a lobster shell, security has layers — review code before you run it.

latestvk97e3engn1sgab12m7cp23e84985a64y
66downloads
0stars
1versions
Updated 5d ago
v0.1.1
MIT-0

宽数题库

用途

当你需要查看、运行、扩展或部署“宽数题库”这个多来源量化题库项目时,使用这个技能。

适合这些场景:

  • 需要快速理解项目是什么、当前公开站点是什么
  • 需要确认仓库中已经接入了哪些题库来源
  • 需要知道原始抓取、标准化数据和页面代码分别放在哪里
  • 需要重新抓取、构建或检查部署前置条件

项目资源

当前接入的题库来源

  • OpenQuant:openquant.co/questions
  • Brainstellar:brainstellar.com/puzzles
  • QuantQuestion:quantquestion.com
  • Jane Street:janestreet.com/puzzles
  • MyntBit:myntbit.com

当前总题量:1454 道。

目录结构

  • data/raw/ 说明:五套来源的原始索引与详情数据
  • data/translations/ 说明:中文翻译与分批翻译产物
  • src/data/questions.json 说明:OpenQuant 标准化数据
  • src/data/brainstellar-questions.json 说明:Brainstellar 标准化数据
  • src/data/quantquestion-questions.json 说明:QuantQuestion 标准化数据
  • src/data/janestreet-questions.json 说明:Jane Street 标准化数据
  • src/data/myntbit-questions.json 说明:MyntBit 标准化数据
  • src/pages/index.astro 说明:首页
  • src/pages/questions/[slug].astro 说明:统一详情页
  • scripts/ 说明:抓取、构建、翻译和部署检查脚本

常用命令

安装依赖:

npm install

抓取与构建:

npm run data:index
npm run data:details
npm run data:brainstellar:index
npm run data:brainstellar:details
npm run data:brainstellar:build
npm run data:quantquestion:fetch
npm run data:quantquestion:build
npm run data:janestreet:index
npm run data:janestreet:details
npm run data:janestreet:translate
npm run data:janestreet:build
npm run data:myntbit
npm run data:validate
npm run data:build

本地开发与验证:

npm run dev
npm run test
npm run check
npm run build

托管与发布

  • GitHub 仓库保持 private
  • 公网托管走 Vercel
  • 生产域名为 https://quantics-bank.vercel.app

Vercel 常用命令:

npx vercel whoami
npx vercel deploy dist --prod --yes

工作建议

如果你是第一次接手这个项目,建议按这个顺序:

  1. README.md
  2. npm run data:validate
  3. npm run build
  4. src/pages/index.astrosrc/pages/questions/[slug].astro
  5. 如果改抓取链,再读 scripts/

公式渲染约束

OpenQuant 原题和中文翻译中的 TeX source 必须保持原样。渲染器只做安全分隔符归一化,不做语义改写;不要把 \operatorname\textrm\mod\dbinomequation 环境改成其他命令来“修正”显示。若页面显示 KaTeX 错误,应先检查源数据本身,而不是在渲染层做猜测性替换。

什么时候用这个技能

  • 想快速知道这个项目现在有哪些题库来源
  • 想确认某道题属于哪个来源
  • 想重新拉取 Brainstellar / Jane Street / MyntBit 等来源
  • 想把本地最新内容重新部署到 Vercel

Comments

Loading comments...