Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Arch Garch Volatility

v0.3.3

用 GARCH 族模型进行波动率建模与预测,支持夏普比率统计推断和 SPA 模型比较测试,应用于全球市场风险管理。

0· 120·0 current·0 all-time
byTang Weigang@tangweigang-jpg

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for tangweigang-jpg/arch-garch-volatility.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Arch Garch Volatility" (tangweigang-jpg/arch-garch-volatility) from ClawHub.
Skill page: https://clawhub.ai/tangweigang-jpg/arch-garch-volatility
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install arch-garch-volatility

ClawHub CLI

Package manager switcher

npx clawhub@latest install arch-garch-volatility
Security Scan
Capability signals
Crypto
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name/description (GARCH volatility modelling, Sharpe bootstrap, SPA test, cointegration) match the included documentation and use-cases. It reasonably depends on the ZVT ecosystem and Python tooling for data collection/backtesting. However the SKILL.md metadata mentions 'Requires Python 3.12+ with uv package manager' while the registry metadata declares no runtime requirements; that discrepancy is unexplained.
!
Instruction Scope
Runtime instructions and seed.yaml preconditions instruct the agent to run Python snippets (python3 -c ...), check for/import zvt, run recorders, and touch files under ZVT_HOME (create/write/delete a test file). These actions reach into the host environment and can cause writes and package installs; the SKILL.md also requires the agent to re-read seed.yaml on behavioral decisions. The instructions reference filesystem paths and env vars not declared in the registry, and grant the agent broad discretion to run host-side checks — this is out of scope for a purely analytical 'model authoring' description and should be reviewed by the user.
Install Mechanism
This is an instruction-only skill with no install spec and no bundled code files. That lowers the risk from arbitrary downloads or extracted archives — there is no explicit install recipe embedded in the skill package.
!
Credentials
The skill declares no required environment variables or credentials, yet its preconditions and seed.yaml reference ZVT_HOME and execute Python commands that read/write that directory and may prompt pip installs (zvt). Requesting writable access to ~/.zvt (or any configured ZVT_HOME) and performing package checks/recorders is reasonable for a data-backtest pipeline, but those capabilities are not declared up front (no required envs, no stated permission requests). This mismatch is a red flag: the skill can access and modify local files and depend on unlisted packages.
Persistence & Privilege
The skill is not 'always:true' and does not request system-wide persistent privileges in the manifest. It does, however, instruct running precondition checks that may create/modify files under the user's ZVT_HOME; these are normal for a recorder/backtest workflow but warrant running in a controlled environment.
What to consider before installing
Before installing or running this skill: (1) Treat it as a tool that expects to run Python commands on your host — it will check for and may ask you to install the 'zvt' package and create/write files under ZVT_HOME (defaults to ~/.zvt). If you don't trust that, do not run it on a production machine. (2) Inspect references/seed.yaml and references/LOCKS.md to understand the preconditions and fatal semantic locks (these can halt execution). (3) Run the skill in an isolated environment (virtualenv / container) with limited filesystem access and no sensitive credentials. (4) If you permit it to run, ensure ZVT_HOME points to a controlled writable directory and review any pip installs before allowing them. (5) Note the skill is proprietary (LICENSE referenced) and that the manifest/metadata contain some mismatches (declared no requirements vs SKILL.md saying Python 3.12+ and uv). If you need stronger assurance, ask the publisher for source/package-level install recipes and an explicit list of runtime permissions/side-effects.

Like a lobster shell, security has layers — review code before you run it.

doramagic-crystalvk97b52m61amvkkhwasjazvr7kn85dghffinancevk97b52m61amvkkhwasjazvr7kn85dghflatestvk97b52m61amvkkhwasjazvr7kn85dghfriskvk97b52m61amvkkhwasjazvr7kn85dghf
120downloads
0stars
5versions
Updated 4d ago
v0.3.3
MIT-0

GARCH 波动率模型 (arch-garch-volatility)

用 GARCH 族模型进行波动率建模与预测,支持夏普比率统计推断和 SPA 模型比较测试,应用于全球市场风险管理。

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (9 total)

Sharpe Ratio Bootstrap Statistical Inference (UC-101)

Computes statistical inference (confidence intervals, standard errors) for the Sharpe Ratio using bootstrap methods to quantify uncertainty in risk-ad Triggers: bootstrap, sharpe ratio, statistical inference

Multiple Model Comparison with SPA Test (UC-102)

Compares 500 predictive models against a benchmark using the Superior Predictive Ability (SPA) test to determine if any models significantly outperfor Triggers: model comparison, SPA test, multiple models

Oil Price Cointegration Analysis (UC-103)

Tests for cointegration relationships between WTI and Brent crude oil prices to identify mean-reverting spread opportunities using Engle-Granger and P Triggers: cointegration, unit root, ADF test

For all 9 use cases, see references/USE_CASES.md.

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

  • Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
  • Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
  • Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
  • Time range: start_timestamp and end_timestamp for backtest period
  • Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

IDRuleOn Violation
SL-01Execute sell orders before buy orders in every trading cyclehalt
SL-02Trading signals MUST use next-bar execution (no look-ahead)halt
SL-03Entity IDs MUST follow format entity_type_exchange_codehalt
SL-04DataFrame index MUST be MultiIndex (entity_id, timestamp)halt
SL-05TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amounthalt
SL-06filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTIONhalt
SL-07Transformer MUST run BEFORE Accumulator in factor pipelinehalt
SL-08MACD parameters locked: fast=12, slow=26, signal=9halt

Full lock definitions: references/LOCKS.md

Top Anti-Patterns (15 total)

  • AP-DERIVATIVES-PRICING-001: Instrument NPV called without attached pricing engine
  • AP-DERIVATIVES-PRICING-002: BSM forward price ignores dividend yield
  • AP-DERIVATIVES-PRICING-003: Negative discount factors passed to log-domain interpolation

All 15 anti-patterns: references/ANTI_PATTERNS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-124. Evidence verify ratio = 47.2% and audit fail total = 32. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

FileContentsWhen to Load
references/seed.yamlV6+ 全量权威 (source-of-truth)有行为/决策争议时必读
references/ANTI_PATTERNS.md15 条跨项目反模式开始实现前
references/WISDOM.md跨项目精华借鉴架构决策时
references/CONSTRAINTS.mddomain + fatal 约束规则冲突时
references/USE_CASES.md全量 KUC-* 业务场景需要完整示例时
references/LOCKS.mdSL-* + preconditions + hints生成回测/交易代码前
references/COMPONENTS.mdAST 组件地图(按 module 拆分)查 API 时

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-124 blueprint at 2026-04-22T13:01:01.570350+00:00. See human_summary.md for non-technical overview.

Comments

Loading comments...