Zipline Daily Backtest

使用 Zipline 框架执行日频股票策略回测，支持多市场数据接入、因子研究、可视化绩效分析，默认本金千万级。。

Security Scan

The skill mostly matches a backtesting helper, but there are multiple inconsistencies (Zipline vs ZVT references, implicit filesystem/env usage, and missing install/credential declarations) that warrant caution before installing or invoking it.

Purpose & Capability

The skill advertises 'Zipline 日频回测' (Zipline daily backtest) and backtesting/factor-research capabilities, which aligns with the included content. However the instructions and many reference files are heavily ZVT-specific (zvt commands, ZVT_HOME, recorders, ZVT anti-patterns) and the seed.yaml mentions 'zipline-reloaded' and a Doramagic host ecosystem. This mixing of Zipline, ZVT, and host-specific orchestration is unexpected: a Zipline-only helper would not normally embed ZVT-specific preconditions and a host execution protocol. The requirement for Python 3.12+ with an 'uv' package manager is also declared but not reconciled with the more typical Zipline/ZVT runtime assumptions.

Instruction Scope

SKILL.md and seed.yaml include explicit runtime steps: agents are instructed to reload seed.yaml, run precondition python -c checks (import zvt, get_kdata etc.), check/create ZVT_HOME, and touch a file under that directory. These runtime actions access environment variables (ZVT_HOME), local filesystem (creating ~/.zvt/.write_test), and attempt to verify installed packages. The skill declares no required env vars/config paths yet its instructions read/write local config and run arbitrary python checks — a mismatch that expands the agent's scope beyond what the metadata declares. There are also execution_protocol directives (install_trigger, host_adapter.install_recipes[]) referenced despite there being no install spec included.

Install Mechanism

There is no install spec and no code files to execute, which lowers supply-chain risk. However seed.yaml and SKILL.md reference host-side install triggers and package verification steps (host_adapter.install_recipes[], 'python3 -m pip install zvt') that are not provided in the package; this is an inconsistency (documentation asks the host to install things but the skill doesn't declare or bundle an install recipe).

Credentials

The registry metadata lists no required environment variables or credentials, yet the instructions and preconditions implicitly rely on ZVT_HOME, on installed Python packages (zvt), and on external data providers (eastmoney, joinquant, akshare, qmt). Some data providers mentioned (joinquant, qmt/broker) require account credentials, but the skill does not declare or request them. The skill may therefore prompt the agent (or user) to supply sensitive API keys during use without that being evident from the metadata.

Persistence & Privilege

always:false (no forced global inclusion) and disable-model-invocation is not set, which is standard. The execution steps reference creating or writing to ~/.zvt (precondition PC-04) and initialize directories via zvt.init_dirs — actions that persist data/config under a user home directory. This is a modest privilege but is not declared in requires.config. There is no indication the skill will alter other skills or system-wide settings.

What to consider before installing

Before installing or running this skill: - Clarify scope: ask the publisher whether this is a Zipline-only skill or a Zipline+ZVT blueprint. The SKILL.md mixes Zipline and ZVT concepts — that matters for runtime behavior. - Expect local side effects: the skill's runtime instructions will check for and may create ~/.zvt and run python import checks; run it in an isolated virtualenv or sandbox to avoid contaminating your global Python environment. - Credentials: if you plan to use paid data providers (joinquant, broker APIs), confirm where/how you must supply API keys — the skill metadata does not declare required env vars but the workflow references providers that need credentials. - Review seed.yaml and references: the package includes a large seed.yaml and many constraint/anti-pattern documents; read those to understand semantic locks (fatal constraints) that the skill enforces (e.g., no look-ahead, T+1 rules, MACD parameter lock). - Evidence quality & safety: the skill notes Evidence verify ratio = 48.1% and audit failures; treat generated code/results as needing independent verification. - If you need least privilege: run any backtests locally with your own controlled data and an explicit virtualenv; don't supply unrelated credentials or allow the agent to run system-wide installers. If you want, I can: (1) extract the exact precondition commands and show the file paths/actions it will perform; (2) produce a safe minimal wrapper (virtualenv + pip requirements) to test the skill in isolation; or (3) draft questions to ask the skill author to resolve the Zipline/ZVT mixing and missing install/credential declarations.

Zipline 日频回测 (zipline-daily-backtest)

使用 Zipline 框架执行日频股票策略回测，支持多市场数据接入、因子研究、可视化绩效分析，默认本金千万级。

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (3 total)

Zipline Documentation Deployment (UC-101)

Automates the process of building and deploying Zipline documentation by cleaning old artifacts, moving files to temporary locations, and preparing do Triggers: deploy, documentation, docs

Zipline Getting Started Tutorial (UC-102)

Provides an interactive tutorial for new Zipline users to learn the platform's core concepts including data ingestion, algorithm execution via CLI and Triggers: tutorial, getting started, learn

Basic Buy-and-Hold Tutorial Algorithm (UC-103)

Demonstrates a minimal Zipline algorithm that places consistent buy orders for a single stock and records price data for later analysis, serving as a Triggers: example, buy apple, simple order

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

• Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
• Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
• Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
• Time range: start_timestamp and end_timestamp for backtest period
• Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

ID	Rule	On Violation
SL-01	Execute sell orders before buy orders in every trading cycle	halt
SL-02	Trading signals MUST use next-bar execution (no look-ahead)	halt
SL-03	Entity IDs MUST follow format entity_type_exchange_code	halt
SL-04	DataFrame index MUST be MultiIndex (entity_id, timestamp)	halt
SL-05	TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amount	halt
SL-06	filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTION	halt
SL-07	Transformer MUST run BEFORE Accumulator in factor pipeline	halt
SL-08	MACD parameters locked: fast=12, slow=26, signal=9	halt

Full lock definitions: references/LOCKS.md

Top Anti-Patterns (25 total)

• AP-ZVT-183: 除权因子为 inf/NaN 时直接参与乘法导致复权静默失败
• AP-ZVT-179: 第三方数据接口超限后异常被吞噬，数据静默缺失
• AP-ZVT-183B: HFQ（后复权）与 QFQ（前复权）K 线表使用错误导致因子计算漂移

All 25 anti-patterns: references/ANTI_PATTERNS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-088. Evidence verify ratio = 48.1% and audit fail total = 19. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

File	Contents	When to Load
references/seed.yaml	V6+ 全量权威 (source-of-truth)	有行为/决策争议时必读
references/ANTI_PATTERNS.md	25 条跨项目反模式	开始实现前
references/WISDOM.md	跨项目精华借鉴	架构决策时
references/CONSTRAINTS.md	domain + fatal 约束	规则冲突时
references/USE_CASES.md	全量 KUC-* 业务场景	需要完整示例时
references/LOCKS.md	SL-* + preconditions + hints	生成回测/交易代码前
references/COMPONENTS.md	AST 组件地图（按 module 拆分）	查 API 时

---

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-088 blueprint at 2026-04-22T13:00:36.495372+00:00. See human_summary.md for non-technical overview.