Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

talib-technical-analysis

v0.3.0

通过 Python 调用 150+ TA-Lib 技术分析指标(均线、MACD、RSI、布林带等),支持多市场金融数据的技术面量化计算。触发场景:(1) 用户要做均线、MACD、RSI 等指标计算;(2) 用户要对股票或加密货币做技术面量化分析;(3) 用户要基于历史 K 线数据生成买卖信号。

0· 0·0 current·0 all-time
byTang Weigang@tangweigang-jpg
Security Scan
Capability signals
Crypto
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md describes Python TA-Lib technical-analysis plus an end-to-end ZVT pipeline (data fetch → backtest). That purpose explains many of the included files (ZVT preconditions, anti-patterns). However the skill claims to 'require Python 3.12+ with uv package manager' but provides an install.sh that does not install ZVT or verify Python 3.12, and the install step attempts to install the TA-Lib C library via a nonstandard/invalid pip string. The presence of dev/build tooling (cibuildwheel, build, pytest) in the one-line installer is disproportionate for a runtime skill.
Instruction Scope
Runtime instructions include sensible domain actions (precondition checks for zvt, creating ~/.zvt, running recorders) which are appropriate for a ZVT-backed backtest flow. They also instruct the agent to reload seed.yaml and follow many internal 'semantic locks' and anti-pattern checks — this grants the agent broad discretion to read project files and write to user data directories (~/.zvt). These filesystem operations are explainable for the stated purpose but should be expected and consented to by the user.
!
Install Mechanism
There is no centralized install spec in registry, but scripts/install.sh exists and runs pip installs. Problems: the script uses an invalid pip package string for the TA-Lib C library ('TA-Lib C library (libta-lib / ta-lib-static)') rather than a known package name or OS-level install; it does not install or verify ZVT even though SKILL.md preconditions require it; it installs many development/build packages (cibuildwheel, build, pytest) that are unnecessary for runtime. Using pip to install a C library dependency for TA-Lib often requires system packages or binary wheels — the script as provided is likely to fail or leave the environment in an unexpected state.
Credentials
The skill does not require any secrets or credentials. It references ZVT_HOME and suggests checking filesystem write permissions, but there are no declared required env vars or keys. No evidence of unnecessary credential access or external tokens.
Persistence & Privilege
always:false and disable-model-invocation:false (defaults) are appropriate. The skill instructs the agent to create/verify local ZVT data directories and may write to those locations, which is expected for a backtest/data recorder workflow. It does not request persistent elevated privileges or alter other skills' configurations.
Scan Findings in Context
[AP-TECHNICAL-ANALYSIS-001] expected: Documented in references/ANTI_PATTERNS.md: passing non-float64 numpy arrays to TA-Lib C FFI can cause memory corruption. This is a legitimate high-risk implementation issue for TA-Lib integrations and should be addressed in code; its presence in the project's anti-patterns is an expected signal (not an attack indicator).
[AP-TECHNICAL-ANALYSIS-002] expected: Documented multidimensional array memory access violations are a known TA-Lib hazard and thus relevant and expected for a TA-Lib binding project.
[AP-TECHNICAL-ANALYSIS-003] expected: Documented risk of ignoring TA_RetCode from C calls — expected and relevant to this skill's domain.
[AP-TECHNICAL-ANALYSIS-005] expected: Time-series index reindexing issues (look-ahead bias) are flagged in project docs and are relevant to backtesting pipelines — expected for this type of skill.
What to consider before installing
This skill declares it will build TA‑Lib based indicators and run ZVT pipelines, but its one provided installer is inconsistent and likely to fail or leave your environment incomplete. Before installing/running: (1) inspect and do not run scripts/install.sh without review — the TA‑Lib C install line is invalid and the script installs development tooling unnecessarily; (2) confirm you have ZVT installed and configured (the SKILL preconditions expect zvt and ~/.zvt write access); (3) run any installs inside an isolated virtualenv or container; (4) verify the project root has the LICENSE and any missing artifacts the SKILL.md references; (5) if you need production reliability, ask the author/source for an authoritative install guide or prebuilt binary wheels for TA‑Lib C. Because the skill includes many documented 'anti-patterns' related to TA‑Lib and low-level C FFI hazards, also review/verify indicator computations on test data before trusting signals for real trading.

Like a lobster shell, security has layers — review code before you run it.

doramagic-crystalvk97687f45grtsma5kes815rdj985c5bsfinancevk97687f45grtsma5kes815rdj985c5bslatestvk97687f45grtsma5kes815rdj985c5bs
0downloads
0stars
1versions
Updated 3h ago
v0.3.0
MIT-0

talib-technical-analysis

I help you build quant strategies on A-share with ZVT — from data fetch to backtest, one flow. Just tell me what you want; I'll write the code, you don't have to dig docs. (Heads up: ZVT natively supports A-share, HK, and crypto. US stocks — stockus_nasdaq_AAPL — are half-baked; don't bother for serious work.)

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (1 total)

TA-Lib Documentation HTML Generator (UC-101)

Converts TA-Lib markdown documentation into styled HTML pages for web publishing, and generates Pygments syntax highlighting CSS for code examples in Triggers: documentation generation, html pages, pygments stylesheet

Install

# One-time setup before first use
bash scripts/install.sh

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

  • Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
  • Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
  • Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
  • Time range: start_timestamp and end_timestamp for backtest period
  • Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

IDRuleOn Violation
SL-01Execute sell orders before buy orders in every trading cyclehalt
SL-02Trading signals MUST use next-bar execution (no look-ahead)halt
SL-03Entity IDs MUST follow format entity_type_exchange_codehalt
SL-04DataFrame index MUST be MultiIndex (entity_id, timestamp)halt
SL-05TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amounthalt
SL-06filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTIONhalt
SL-07Transformer MUST run BEFORE Accumulator in factor pipelinehalt
SL-08MACD parameters locked: fast=12, slow=26, signal=9halt

Full lock definitions: references/LOCKS.md

Top Anti-Patterns (15 total)

  • AP-TECHNICAL-ANALYSIS-001: C FFI Type Mismatch with Non-float64 Arrays
  • AP-TECHNICAL-ANALYSIS-002: Multidimensional Array Memory Access Violations
  • AP-TECHNICAL-ANALYSIS-003: Ignoring TA_RetCode Error Status from C Calls

All 15 anti-patterns: references/ANTI_PATTERNS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-109. Evidence verify ratio = 45.1% and audit fail total = 35. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

FileContentsWhen to Load
references/seed.yamlV6+ 全量权威 (source-of-truth)有行为/决策争议时必读
references/ANTI_PATTERNS.md15 条跨项目反模式开始实现前
references/WISDOM.md跨项目精华借鉴架构决策时
references/CONSTRAINTS.mddomain + fatal 约束规则冲突时
references/USE_CASES.md全量 KUC-* 业务场景需要完整示例时
references/LOCKS.mdSL-* + preconditions + hints生成回测/交易代码前
references/COMPONENTS.mdAST 组件地图(按 module 拆分)查 API 时

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-109 blueprint at 2026-04-22T13:00:52.305302+00:00. See human_summary.md for non-technical overview.

Comments

Loading comments...