Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Backtrader Event Driven

v0.3.3

运行经典双均线交叉策略回测,事件驱动模拟信号生成与持仓,输出 PyFolio 绩效报告。

0· 106·0 current·0 all-time
byTang Weigang@tangweigang-jpg

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for tangweigang-jpg/backtrader-event-driven.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Backtrader Event Driven" (tangweigang-jpg/backtrader-event-driven) from ClawHub.
Skill page: https://clawhub.ai/tangweigang-jpg/backtrader-event-driven
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install backtrader-event-driven

ClawHub CLI

Package manager switcher

npx clawhub@latest install backtrader-event-driven
Security Scan
Capability signals
CryptoRequires walletCan make purchasesRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
SKILL.md and companion files clearly implement a backtesting pipeline built on Python and ZVT (data recorders, providers like eastmoney/joinquant, ZVT_HOME). However the registry metadata lists no required binaries, no required env vars, and no install spec. The declared surface (no dependencies) does not match the skill's actual needs (Python 3.12+, zvt, data providers).
!
Instruction Scope
Runtime instructions (SKILL.md + seed.yaml + LOCKS.md/PC preconditions) tell an agent to run Python checks, potentially run pip install zvt, touch files under ~/.zvt, and enforce many fatal semantic locks (T+1, no look-ahead, specific DataFrame schemas). These are reasonable for a backtest tool, but the instructions also expect the agent to run environment-changing commands and to use external data providers (which may require credentials) — none of which are declared or scoped in the registry metadata.
Install Mechanism
The skill is instruction-only and has no declared install spec (lowest-risk form). However seed.yaml/execution_protocol references host_adapter.install_recipes[] and the SKILL.md header explicitly requires Python 3.12+ with the 'uv' package manager; this implicit install expectation isn't surfaced in the registry. The absence of an explicit, traceable install mechanism (e.g., a known package release) is an omission worth flagging.
!
Credentials
No environment variables or credentials are declared, yet the content references ZVT_HOME, pip installing zvt, and choosing providers like joinquant/qmt/eastmoney (some of which require API keys/accounts). The skill may ask users for provider credentials at runtime but does not declare or justify any required secret/env vars in the manifest — disproportionate and missing declarations.
Persistence & Privilege
always:false and no install spec mean the skill does not demand persistent, forced inclusion. However seed.yaml's execution_protocol instructs agents to 'reload seed.yaml', run preconditions, and run host install recipes if present — which implies the agent may execute environment-modifying commands during use. Autonomous invocation is allowed (platform default) and should be considered together with the other concerns.
What to consider before installing
This skill appears to be a legitimate backtesting helper, but the package metadata underreports what it actually needs. Before installing or running it: (1) confirm you have Python 3.12+ and an isolated virtual environment; (2) expect to need zvt and possibly data-provider credentials (eastmoney is free, joinquant/qmt require accounts) — ask the skill author to declare required env vars (e.g., JOINQUANT_TOKEN, QMT_API_KEY) and explicit install steps; (3) don't run it in a production / credentialed machine until you verify what commands it will execute (seed.yaml requests host install recipes and precondition pip installs); (4) review/validate the references/seed.yaml and LOCKS.md semantics (they enforce fatal constraints like next-bar execution and T+1 rules); and (5) run first in an isolated sandbox to confirm no unexpected network calls or writes. If the author cannot provide explicit dependency and credential declarations, treat the skill as untrusted.

Like a lobster shell, security has layers — review code before you run it.

analyticsvk974zcx9d9n4w46djj8060p9d185d4hmdatavk974zcx9d9n4w46djj8060p9d185d4hmdoramagic-crystalvk974zcx9d9n4w46djj8060p9d185d4hmfinancevk974zcx9d9n4w46djj8060p9d185d4hmlatestvk974zcx9d9n4w46djj8060p9d185d4hmportfoliovk974zcx9d9n4w46djj8060p9d185d4hmquantvk974zcx9d9n4w46djj8060p9d185d4hm
106downloads
0stars
4versions
Updated 4d ago
v0.3.3
MIT-0

Backtrader 事件回测 (backtrader-event-driven)

运行经典双均线交叉策略回测,事件驱动模拟信号生成与持仓,输出 PyFolio 绩效报告。

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (2 total)

SMA Crossover Backtester with PyFolio Analytics (UC-101)

Implements a classic dual moving average crossover trading strategy using backtrader, generating LONG/LONGSHORT signals when fast and slow SMAs cross, Triggers: backtrader, SMA crossover, moving average

OHLC Data Printer Utility (UC-102)

Provides a minimal backtrader strategy that logs and prints OHLC (Open, High, Low, Close) data in CSV format for debugging and verifying data feed int Triggers: backtrader, data printing, OHLC logging

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

  • Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
  • Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
  • Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
  • Time range: start_timestamp and end_timestamp for backtest period
  • Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

IDRuleOn Violation
SL-01Execute sell orders before buy orders in every trading cyclehalt
SL-02Trading signals MUST use next-bar execution (no look-ahead)halt
SL-03Entity IDs MUST follow format entity_type_exchange_codehalt
SL-04DataFrame index MUST be MultiIndex (entity_id, timestamp)halt
SL-05TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amounthalt
SL-06filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTIONhalt
SL-07Transformer MUST run BEFORE Accumulator in factor pipelinehalt
SL-08MACD parameters locked: fast=12, slow=26, signal=9halt

Full lock definitions: references/LOCKS.md

Top Anti-Patterns (25 total)

  • AP-ZVT-183: 除权因子为 inf/NaN 时直接参与乘法导致复权静默失败
  • AP-ZVT-179: 第三方数据接口超限后异常被吞噬,数据静默缺失
  • AP-ZVT-183B: HFQ(后复权)与 QFQ(前复权)K 线表使用错误导致因子计算漂移

All 25 anti-patterns: references/ANTI_PATTERNS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-086. Evidence verify ratio = 28.8% and audit fail total = 15. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

FileContentsWhen to Load
references/seed.yamlV6+ 全量权威 (source-of-truth)有行为/决策争议时必读
references/ANTI_PATTERNS.md25 条跨项目反模式开始实现前
references/WISDOM.md跨项目精华借鉴架构决策时
references/CONSTRAINTS.mddomain + fatal 约束规则冲突时
references/USE_CASES.md全量 KUC-* 业务场景需要完整示例时
references/LOCKS.mdSL-* + preconditions + hints生成回测/交易代码前
references/COMPONENTS.mdAST 组件地图(按 module 拆分)查 API 时

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-086 blueprint at 2026-04-22T13:00:35.750880+00:00. See human_summary.md for non-technical overview.

Comments

Loading comments...