Reactive Pricing Engine

基于OTC衍生品组合的XVA估值与风险指标计算，支持CVA/DVA/FVA度量及敞口曲线生成；提供SIMM保证金敏感性分析，兼容多定价引擎配置。

Security Scan

The skill's documentation describes a complex XVA/pricing engine but its runtime instructions claim substantial runtime requirements (Python 3.12+, zvt, data recorders, installation steps referenced in seed.yaml) while the registry declares no binaries, no env vars, and no install—these mismatches and missing dependency/credential declarations are concerning.

Purpose & Capability

SKILL.md and the included files describe a full-featured XVA/pricing pipeline that expects Python 3.12+, the 'uv' package manager, and the zvt ecosystem (recorders, data providers). The registry metadata, however, lists no required binaries, no required env vars, and no install spec. That mismatch is incoherent: a quant/pricing engine legitimately needs Python and packages (and often credentials for paid data providers), so the skill's declared surface does not match what it actually requires.

Instruction Scope

The runtime instructions and seed.yaml instruct the agent to re-load seed.yaml, run precondition checks (e.g., python3 -c 'import zvt' and running zvt recorders), run precondition installation flows, and execute data recorders that fetch market data. These steps access local paths (ZVT_HOME), may run pip/install commands, and will trigger network activity to data providers. The skill does not declare these actions or the credentials they may need, and the instructions give broad discretion to run install/recorder commands—scope is broader than the registry indicates.

Install Mechanism

No install spec is present in the registry, but seed.yaml's execution_protocol explicitly requires executing resources.host_adapter.install_recipes[] and 'Verify each package with import check before proceeding'. That implies dynamic installs or host-side recipes will run, yet nothing is declared. This mismatch increases risk because host-side installation behavior is unspecified and could download/install packages at runtime.

Credentials

The skill references external data providers (eastmoney, joinquant, akshare, qmt) and commands that will access the filesystem and ZVT_HOME, but the registry declares no required environment variables or credentials. Paid providers (e.g., joinquant) typically require API keys/accounts. The absence of declared env vars or a primary credential is disproportionate to the described capabilities and hides what secrets the skill will need or attempt to use.

Persistence & Privilege

always:false and model invocation are normal. The skill does not request forced always-on presence. However seed.yaml prescribes a multi-step execution protocol (reloading seed.yaml before decisions, running host install recipes) which gives the skill substantial operational control when executed: it expects the host to run install recipes and preconditions. This is not an 'always:true' privilege, but it does give the skill a non-trivial runtime footprint on the host if allowed to execute installs.

What to consider before installing

Do not enable this skill for autonomous runs yet. Key things to check before installing or running it: 1) Ask the publisher for the missing install spec and a clear dependency list (Python version, pip/uv packages, exact pip/conda packages) and a LICENSE.txt—the SKILL.md mentions these but the registry lacks them. 2) Confirm which external data providers will be used and what credentials are needed; never supply API keys until you understand minimal required scopes. 3) Review seed.yaml / host_adapter.install_recipes to see any install URLs or host-side scripts the skill will run; if those download archives or run arbitrary installers, treat as high risk. 4) Run first in an isolated/sandbox environment (VM/container) and with network access restricted, or only after code review. 5) If you need the functionality but want lower risk, request a pared-down instruction-only version that lists exact dependencies (no implicit host install recipes) or provide a vetted Docker image that contains the runtime. If you cannot obtain those assurances, consider this skill suspicious and avoid exposing credentials or allowing automatic installs.

XVA 定价引擎 (reactive-pricing-engine)

基于OTC衍生品组合的XVA估值与风险指标计算，支持CVA/DVA/FVA度量及敞口曲线生成；提供SIMM保证金敏感性分析，兼容多定价引擎配置。

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (19 total)

Dynamic SIMM Exposure Analysis (UC-101)

Analyzes collateralized vs uncollateralized counterparty exposure dynamics for risk management and margin calculations Triggers: initial margin, SIMM, collateral

XVA Valuation and Sensitivity Reporting (UC-102)

Computes and visualizes XVA metrics including CVA, DVA, FVA, and exposure profiles for OTC derivatives portfolio Triggers: XVA, CVA, FVA

Portfolio NPV Cashflow and Curve Reporting (UC-106)

Generates comprehensive portfolio reports including NPV, cashflows, and yield curves for trade valuation Triggers: NPV, cashflow, curves

For all 19 use cases, see references/USE_CASES.md.

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

• Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
• Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
• Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
• Time range: start_timestamp and end_timestamp for backtest period
• Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

ID	Rule	On Violation
SL-01	Execute sell orders before buy orders in every trading cycle	halt
SL-02	Trading signals MUST use next-bar execution (no look-ahead)	halt
SL-03	Entity IDs MUST follow format entity_type_exchange_code	halt
SL-04	DataFrame index MUST be MultiIndex (entity_id, timestamp)	halt
SL-05	TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amount	halt
SL-06	filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTION	halt
SL-07	Transformer MUST run BEFORE Accumulator in factor pipeline	halt
SL-08	MACD parameters locked: fast=12, slow=26, signal=9	halt

Full lock definitions: references/LOCKS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-104. Evidence verify ratio = 38.9% and audit fail total = 7. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

File	Contents	When to Load
references/seed.yaml	V6+ 全量权威 (source-of-truth)	有行为/决策争议时必读
references/ANTI_PATTERNS.md	0 条跨项目反模式	开始实现前
references/WISDOM.md	跨项目精华借鉴	架构决策时
references/CONSTRAINTS.md	domain + fatal 约束	规则冲突时
references/USE_CASES.md	全量 KUC-* 业务场景	需要完整示例时
references/LOCKS.md	SL-* + preconditions + hints	生成回测/交易代码前
references/COMPONENTS.md	AST 组件地图（按 module 拆分）	查 API 时

---

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-104 blueprint at 2026-04-22T13:00:49.125318+00:00. See human_summary.md for non-technical overview.