Tai Alpha Stock

Tai Alpha stock analysis — collect, VectorBT backtest (RSI/MACD/BB), conviction score, optional ML. Persistence is SQLite (default tai_alpha_output/tai_alpha...

Security Scan

The skill is internally coherent for stock analysis: it uses yfinance + VectorBT, stores results in SQLite, and its scripts match the documented workflows — there are a few minor documentation/env-var gaps and an optional webhook that could send data externally which you should review before running.

Purpose & Capability

Name/description match the code and docs: the package implements collection (yfinance), VectorBT backtests (RSI/MACD/BB), scoring, optional ML, and SQLite persistence. Declared Python dependencies in pyproject (numpy, pandas, yfinance, vectorbt, scikit-learn, pyyaml) are appropriate for the stated features. No unrelated cloud credentials, binaries, or surprising external services are required by default.

Instruction Scope

SKILL.md and the thin CLI scripts instruct the agent to run local Python scripts (collect, backtest, score, report, cron, etc.). The runtime behavior stays within the stated domain: network fetches (Yahoo via yfinance, optional CoinGecko) and writes to a local SQLite DB. One operational behavior to be aware of: the cron/hotlist path supports sending notifications to a Telegram webhook (TAI_ALPHA_TELEGRAM_WEBHOOK) — that will transmit report/watchlist data to an external endpoint if configured. This is expected for an alerts feature, but you should vet any webhook URLs before enabling them.

Install Mechanism

No install spec in the skill manifest (instruction-only). The bundle includes full source and a pyproject.toml for a normal pip install (editable dev install) — conventional and traceable. There are no download-from-untrusted-URL installers or extract-from-remote steps in the provided files. The included scripts for publishing to ClawdHub invoke npm when run, but that is an optional, explicit authoring/publish workflow — not an automatic install step.

Credentials

The skill references several environment variables in docs and code (TAI_ALPHA_DB_PATH, TAI_ALPHA_OUTPUT_DIR, optional TAI_ALPHA_HOTLIST and TAI_ALPHA_TELEGRAM_WEBHOOK, and optional TAI_ALPHA_CN_SOURCE) but declares no required env vars in the registry metadata. Not declaring these makes it harder to audit what secrets or external endpoints might be used. In particular, a configured Telegram webhook would be a secret/URL that causes outbound transmission of report/watchlist data. This mismatch is an oversight (not necessarily malicious) but worth noting and reconciling before use.

Persistence & Privilege

The skill writes a local SQLite DB by design (default: tai_alpha_output/tai_alpha.db) and will create/modify that file when run. always:false and model-invocation defaults are set; there is no elevated or persistent platform privilege requested. Take care not to run it against a production DB path you care about (docs note this), and consider specifying a dedicated DB path when testing.

Scan Findings in Context

[pre-scan-none] expected: No regex-based injection signals were detected by the pre-scan. The codebase is sizable but uses normal libraries and network sources (yfinance, optional CoinGecko); absence of findings does not eliminate the need to audit webhook/secret usage.

Assessment

This skill appears to do what it says (collect market data, run backtests, compute conviction scores, optionally run a small ML model and persist results to SQLite). Before installing/running: 1) Decide where you want the SQLite DB and pass --db-path or set TAI_ALPHA_DB_PATH/TAI_ALPHA_OUTPUT_DIR to avoid overwriting other files. 2) Do not set a Telegram webhook (TAI_ALPHA_TELEGRAM_WEBHOOK) or other webhook until you trust/verify the destination, because cron/alerts can send data externally. 3) The skill expects network access to Yahoo (yfinance) and optionally CoinGecko — run only in an environment where that network I/O is acceptable. 4) The registry metadata omits env var declarations that are used by the code/docs; consider treating those envs as secrets and review any values before use. 5) If you plan to run the publish script, note it will call npm and temporarily install clawdhub/undici — only run that if you intend to publish. If you want extra assurance, run the unit tests locally (pip install -e '.[dev]' and pytest) and inspect the specific scripts you plan to use (cron, alerts, or any code that posts to external endpoints).

Canonical docs: /setup (README, USERFLOW, MODULE_STRUCTURE, guides).
Mirror: setup/docs/core/SKILL.md.
Agents (Cursor / Claude Code / OpenClaw): setup/docs/core/AGENTS.md — root stubs AGENTS.md, CLAUDE.md.

Workflow tree

• Single: python scripts/analyze.py TICKER → pipeline; stores rows in SQLite (--db-path optional).
• Personas / markets: --persona id / --persona-all; --market auto|us|hk|cn; --lang zh-CN|zh-HK (see setup/docs/guides/PERSONA_ECOSYSTEM_GUIDE.md).
• Fast / depth: --fast skips ML and uses lighter collect; --depth lite|standard|deep (see setup/README.md matrix).
• Batch: python scripts/batch.py TICKER1 TICKER2 (optional --fast, --depth).
• Portfolio: python scripts/portfolio.py TICKER ...
• Cron: python scripts/cron.py (TAI_ALPHA_HOTLIST, optional TAI_ALPHA_TELEGRAM_WEBHOOK)
• Alerts: python scripts/alerts.py (watchlist in SQLite)
• Custom / ML / sector: scripts/custom.py, scripts/ml.py, scripts/sector.py
• Dividends / movers: scripts/dividends.py, scripts/hot_scanner.py (see setup README)
• Inspect run: python scripts/report.py --run-id N / python scripts/score.py --run-id N (--deep-risk on score CLI)

Docs

• setup/docs/guides/DISCLAIMER_AND_LIMITATIONS.md
• setup/docs/guides/STRATEGIES.md
• setup/docs/database/SQLITE.md
• setup/docs/core/AGENT_GUIDE.md
• setup/docs/guides/PERSONA_ECOSYSTEM_GUIDE.md
• setup/docs/guides/CHINESE_AUDIENCE_GUIDE.md

Related projects (inspiration)

• openclaw/stock-analysis skill
• UZI-Skill

Test

pip install -e ".[dev]"
pytest tests/unit tests/integration -v
python setup/tools/check_structure.py