Trading Agents Cn

基于 LLM 的 A 股多智能体交易分析框架，支持批量选股对比、回测信号生成和因子研究，自带 OpenAI 兼容 API 适配器模板。

Security Scan

The skill claims to be a trading/backtesting framework but its runtime instructions reference many external data providers, LLM adapters, and local Python preconditions while the manifest declares no required credentials or install steps — the pieces are inconsistent and you should verify missing requirements before installing.

Purpose & Capability

The SKILL.md describes an end-to-end A‑share multi-agent trading framework that integrates with data providers (eastmoney, joinquant, baostock, akshare, tushare/qmt) and OpenAI‑compatible LLM providers, and contains crawlers for social and internal messages. However the registry metadata declares no required environment variables, no required binaries, and no install spec. Real usage of the listed providers and examples would normally require API keys/tokens and Python packages (zvt, tushare, jqdatasdk, LLM provider SDKs). This mismatch (claimed integrations but no declared credentials/dependencies) is incoherent.

Instruction Scope

The runtime instructions (SKILL.md/seed.yaml) instruct agents to run precondition checks (python -c 'import zvt', get_kdata, check ZVT_HOME and writable directories), to reload seed.yaml, and to follow semantic locks before executing trading/backtest actions. Use cases and examples reference crawlers including 'internal_message_crawler.py' and social media crawlers — i.e., the skill expects to fetch external data and potentially internal messages. The skill text instructs agents to consult and cite many internal reference files. The instructions therefore expect filesystem access, running Python checks, network I/O and use of external API credentials — but none of these resources are declared in the manifest, creating a scope/privilege ambiguity the agent user should confirm.

Install Mechanism

This is an instruction-only skill with no install spec and no code files, so nothing will be written to disk by an automatic install. The SKILL.md does state a runtime expectation (Python 3.12+ and the 'uv' package manager) but does not provide an installer. Lack of an install hook reduces immediate supply‑chain risk, but the skill expects runtime use of external Python packages and recorders (zvt, data recorders) which the agent or user will need to install manually — verify any manual installation sources before proceeding.

Credentials

The skill manifest lists no required environment variables or primary credential, yet SKILL.md and referenced use cases clearly rely on credentials (Tushare token, JoinQuant/jqdatasdk credentials, broker qmt tokens, OpenAI/BaiLian/DeepSeek API keys, possibly MongoDB or Redis connection strings). That mismatch is a red flag: the skill may prompt you at runtime for multiple sensitive tokens or expect them to exist on the host. Also some use cases mention 'internal message' crawlers which could access private/corporate data — confirm what credentials and network endpoints will be used and whether any secrets might be requested or stored.

Persistence & Privilege

The skill is not always-enabled (always: false), has no install spec and no code that would persistently modify agent configuration. It does not request system‑wide privileges in its manifest. However, the seed.yaml/execute protocol requires the host to run preconditions and possibly host_adapter.install_recipes if present — since none are declared, there is no evidence this skill will forcibly persist itself. Still, because it can be invoked autonomously (standard default), treat it like any network-capable skill and review requested credentials before allowing autonomous runs.

What to consider before installing

This skill claims to be a full trading/backtest framework but the manifest omits many real runtime requirements. Before installing or invoking it: - Ask the publisher (or inspect the full source) for an explicit list of required environment variables and secrets (TUSHARE_TOKEN, JQDATA credentials, TUSHARE_PRO_TOKEN, QMT/BROKER tokens, MONGODB/REDIS URIs, and any LLM provider API keys). Do not supply secrets until you know exactly what will use them and where they'll be stored. - Review the examples/crawlers referenced (social_media_crawler, internal_message_crawler). Confirm whether the 'internal' crawler requires access to corporate systems or private message stores; if so, avoid granting broad network or filesystem access. - Because the skill expects Python packages (zvt, data recorders, SDKs), install and run it first inside an isolated environment (VM or sandbox container) and inspect what network connections it makes when executed. Do not run on a production machine with secrets mounted. - Confirm license and provenance. There is no homepage/source URL; prefer packages with a verifiable upstream repository or published releases. The SKILL.md claims 'Proprietary' license but no LICENSE file in registry metadata — ask for it. - Verify semantic locks and constraints (T+1, next-bar execution, locked MACD params) align with your intended use; those are hard constraints in the documentation and might halt or change execution. Given the clear mismatch between declared and implied requirements, treat this skill as untrusted until you can verify its required credentials, inspect the example crawler code, and run it in a controlled sandbox.

A 股多智能体 (trading-agents-cn)

基于 LLM 的 A 股多智能体交易分析框架，支持批量选股对比、回测信号生成和因子研究，自带 OpenAI 兼容 API 适配器模板。

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (29 total)

LLM Adapter Template for OpenAI-Compatible Providers (UC-101)

Users need a template to create custom LLM adapters for OpenAI-compatible API providers to integrate with TradingAgents framework Triggers: llm adapter, openai compatible, custom provider

Batch Stock Analysis with Comparison Reports (UC-102)

Investors need to analyze multiple stocks simultaneously and generate comparison reports for portfolio selection and sector analysis Triggers: batch analysis, multiple stocks, comparison report

Custom Stock Analysis with Focus Selection (UC-108)

Investors need customized stock analysis with selectable focus areas like technical, fundamental, risk assessment, or sector comparison Triggers: custom analysis, analysis focus, personalized

For all 29 use cases, see references/USE_CASES.md.

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

• Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
• Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
• Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
• Time range: start_timestamp and end_timestamp for backtest period
• Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

ID	Rule	On Violation
SL-01	Execute sell orders before buy orders in every trading cycle	halt
SL-02	Trading signals MUST use next-bar execution (no look-ahead)	halt
SL-03	Entity IDs MUST follow format entity_type_exchange_code	halt
SL-04	DataFrame index MUST be MultiIndex (entity_id, timestamp)	halt
SL-05	TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amount	halt
SL-06	filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTION	halt
SL-07	Transformer MUST run BEFORE Accumulator in factor pipeline	halt
SL-08	MACD parameters locked: fast=12, slow=26, signal=9	halt

Full lock definitions: references/LOCKS.md

Top Anti-Patterns (25 total)

• AP-ZVT-183: 除权因子为 inf/NaN 时直接参与乘法导致复权静默失败
• AP-ZVT-179: 第三方数据接口超限后异常被吞噬，数据静默缺失
• AP-ZVT-183B: HFQ（后复权）与 QFQ（前复权）K 线表使用错误导致因子计算漂移

All 25 anti-patterns: references/ANTI_PATTERNS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-099. Evidence verify ratio = 32.5% and audit fail total = 33. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

File	Contents	When to Load
references/seed.yaml	V6+ 全量权威 (source-of-truth)	有行为/决策争议时必读
references/ANTI_PATTERNS.md	25 条跨项目反模式	开始实现前
references/WISDOM.md	跨项目精华借鉴	架构决策时
references/CONSTRAINTS.md	domain + fatal 约束	规则冲突时
references/USE_CASES.md	全量 KUC-* 业务场景	需要完整示例时
references/LOCKS.md	SL-* + preconditions + hints	生成回测/交易代码前
references/COMPONENTS.md	AST 组件地图（按 module 拆分）	查 API 时

---

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-099 blueprint at 2026-04-22T13:00:44.877519+00:00. See human_summary.md for non-technical overview.