ETF模拟交易回测系统
Analysis
The artifacts describe a coherent simulated ETF backtesting tool, with only purpose-aligned notes around external market-data access, optional scheduled execution, and undeclared runtime dependency details.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
可通过Cron设置每日定时执行：- 9:30 开盘分析 - 14:50 尾盘确认 - 15:00 收盘复盘
The documentation suggests optional scheduled execution. It is disclosed and user-directed, but scheduled jobs are a form of persistence if the user sets them up.
import requests
The script depends on Python's requests package, but the metadata and install specification do not declare runtime dependencies. This is a completeness/provenance note, not evidence of malicious behavior.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
url = f"http://push2.eastmoney.com/api/qt/stock/get" ... resp = requests.get(url, params=params, timeout=5)
The script retrieves market data from an external provider over HTTP. This is aligned with the backtesting purpose, but the data source and transport affect the integrity of generated signals and reports.