Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Wyckoff Diagnose

v1.2.0

Wyckoff 2.0 诊股系统。输入任意A股代码,输出完整分析报告(Phase状态、Volume Profile关键价位,综合评分、评级、操作建议)。支持右侧趋势🅡和左侧积累🅁双视角诊断。当用户要求"诊股"、"分析股票"、"帮我看看XXX"、"这个股怎么样"、"诊断"时触发。支持输入6位股票代码。

0· 129·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for dxarch1980/wyckoff-diagnose.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Wyckoff Diagnose" (dxarch1980/wyckoff-diagnose) from ClawHub.
Skill page: https://clawhub.ai/dxarch1980/wyckoff-diagnose
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install wyckoff-diagnose

ClawHub CLI

Package manager switcher

npx clawhub@latest install wyckoff-diagnose
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill claims to fetch data via efinance in SKILL.md, but the runtime code tries three sources in order (tushare → baostock → efinance). Including multiple data adapters is plausible for robustness, but the SKILL.md does not document the tushare adapter or the use of a custom remote endpoint. The presence of a hardcoded Tushare token and custom HTTP URL in ts_data.py is not justified by the README and is disproportionate to a simple analysis task.
!
Instruction Scope
SKILL.md describes pulling daily data (mentions efinance) and computing indicators. The code follows that workflow, but it also will send requests to an externally hosted Tushare-compatible service (ts_data._http_url = 'http://140.143.209.128:5000') using an embedded token. The instructions do not warn that queries (stock codes, dates) may transit an unvetted remote server, which broadens the skill's runtime scope beyond what the documentation states.
Install Mechanism
There is no install spec (no archive downloads). That's lower risk. However, the shipped Python scripts require several third‑party packages (tushare, efinance, baostock, scipy, pandas) that are not declared anywhere; running the skill will attempt network I/O to third‑party APIs. No arbitrary remote downloads are present in the package itself.
!
Credentials
The skill declares no required environment variables or credentials, yet ts_data.py embeds a long Tushare token and overrides the API HTTP URL to an IP address. Hardcoding a credential and pointing to an unlisted IP is disproportionate and suspicious — it effectively delegates data access (and visibility into queries) to a third party without informing the user or requesting their own API key.
Persistence & Privilege
The skill is not marked always:true, does not request system-level config paths, and does not modify other skills. It appears to run only when invoked and does not persist changes to broader agent configuration.
What to consider before installing
Caution: the code includes a hardcoded Tushare token and a custom API host (http://140.143.209.128:5000). That means your stock-code queries would be routed (and visible) to that remote server using the embedded credential. Before installing or running: 1) inspect ts_data.py and consider removing or replacing the hardcoded TOKEN/_http_url; 2) prefer configuring your own TUSHARE token via an environment variable and using the official Tushare endpoint; 3) if you can't validate the remote host, run the skill in a network‑restricted sandbox or block outbound access to that IP; 4) ask the publisher to explain why a private HTTP host is used and to update SKILL.md to document all data sources and required credentials. If you need a safe quick test, edit diagnose.py to force it to use only efinance or baostock (remove/disable ts_data usage) so queries do not go to the unknown endpoint.

Like a lobster shell, security has layers — review code before you run it.

latestvk979vcyp9gfw9q0py9yt0exdts83q1rg
129downloads
0stars
3versions
Updated 1mo ago
v1.2.0
MIT-0

Wyckoff 诊股系统

工作流程

第一步:拉取日线数据
  → efinance stock.get_quote_history(code, klt=101, fqt=1)
  → 至少需要60根日线,不足则返回"数据不足"

第二步:计算 Volume Profile
  → calculate_vp(df) → VPOC / VAH / VAL / HVN / LVN
  → 将价格切成50个层级,统计每层成交量

第三步:识别 Wyckoff Phase
  → detect_phase(df) → Phase A~E + 方向(积累/派发/测试/趋势)
  → 基于均线关系 + 价格在区间位置 + 成交量比率判断

第四步:综合评分
  → score_stock(df) → 评分(0~100) + 评级(S/A/B/C/D) + 红绿信号

第五步:输出报告
  → 评级 + Phase状态 + 关键价位 + 评分 + 红绿信号 + 操作建议

核心脚本

  • scripts/diagnose.py — 诊股主脚本,输出完整报告
  • scripts/wyckoff_engine.py — 核心算法

关键价位说明

术语含义交易意义
VPOC成交量最大的价格重心,看多者需站上才确认
VAH价值区上沿(68%)短期阻力
VAL价值区下沿(68%)短期支撑
HVN高成交量节点磁铁区,价格常被吸引回去
LVN低成交量节点拒绝区,通常是支撑/阻力

Phase 判断规则

Phase E(趋势):均线多头 + 价格在区间上方 → 持有/追涨
Phase A(停止):量能突然放大 + 价格波动减小 → 趋势尾声
Phase B(横盘):区间震荡 + 量能萎缩 → 积累/派发
Phase C(测试):价格测试边界(Spring/Upthrust)→ 等待确认
Phase D(突破):放量突破区间边界 → 入场信号

评级说明

评级含义操作建议
🅢 S强烈推荐(≥75分)重点关注,回调买入
🄰 A重点关注(60~74分)满足买入条件,可以关注
🄱 B观察(40~59分)信号不明确,等待确认
🄲 C不建议(<40分)存在风险,不宜买入
🄳 D回避风险过高,建议回避

双视角诊断

诊股系统同时支持右侧趋势左侧积累两种视角分析:

右侧趋势(默认)

逻辑: 等趋势确认了才买,核心是"突破跟进"

  • Phase E 上涨趋势 / Phase D 向上突破 + 价格在 VPOC 上方 → 🅢🄰
  • Phase C Spring 测试后价格收回 VPOC → 待确认
  • 价格在 VPOC/VAL 下方 → 🔴 回避

左侧积累

逻辑: 主力悄悄收集、价格还在低位,提前埋伏等拉升

  • Phase B 积累区间 + 价格在区间低位 → 🅢🄰 重点关注
  • 价格紧贴 LVN 支撑 / 在 VAL 下方低位 → ✅ 加分
  • 缩量止跌(5日均量 < 20日均量)→ ✅ 主力在吸筹
  • Phase E 下跌趋势 / 放量下跌 → 🔴 不抄底

调用方式

# 默认:同时输出双视角报告
python scripts/diagnose.py 000001

# 仅右侧趋势
python scripts/diagnose.py 000001 --side right

# 仅左侧积累
python scripts/diagnose.py 000001 --side left

# 批量(文件)
python scripts/diagnose.py -f stocks.txt --side both

评分维度

维度加分项扣分项
PhasePhase B积累/D突破/E上涨趋势Phase B派发/C upthrust/E下跌
价格位置在VPOC上方/VAH上方在VPOC下方/VAL下方
成交量近5日均量>60日均量×1.5(机构信号)缩量
支撑下方有LVN(<5%距离)无有效支撑

常见问题

Q:Phase 显示 unknown 是怎么回事? A:价格/成交量关系刚好落在边界条件上(极少发生),代表行情处于横盘过渡状态,不是数据问题。

Q:评级和评分是什么关系? A:评分是0~100的数值,评级是评分映射的S/A/B/C/D档位。60分以上才是🄰推荐级别。

Q:Phase B accumulation 为什么只给🄱而不直接买入? A:Phase B只是机构在收集,还未发动。真正的买入信号需要等待Phase C的Spring确认——价格短暂跌破支撑后快速收回并站上VPOC。

Comments

Loading comments...