Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Credit Transition Matrix

v0.3.3

处理信用评级转移矩阵,支持Not-Rated状态重分配、年度与月度矩阵转换、状态空间定义及数据集表征。

0· 63·0 current·0 all-time
byTang Weigang@tangweigang-jpg

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for tangweigang-jpg/credit-transition-matrix.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Credit Transition Matrix" (tangweigang-jpg/credit-transition-matrix) from ClawHub.
Skill page: https://clawhub.ai/tangweigang-jpg/credit-transition-matrix
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install tangweigang-jpg/credit-transition-matrix

ClawHub CLI

Package manager switcher

npx clawhub@latest install credit-transition-matrix
Security Scan
Capability signals
Crypto
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill's name/description focus on 'credit transition matrices', which is coherent with the included reference docs. However SKILL.md also contains explicit trading/backtest pipeline elements (data_collection -> ... -> trading_execution), ZVT/ZVT recorder/backtest use-cases, MACD/trading semantic locks and user prompts about markets/data providers. This mixes credit-matrix functionality with trading/execution responsibilities; it's unclear why a pure transition-matrix skill must include trading-execution semantics and backtest-specific constraints. Also SKILL.md states 'Requires Python 3.12+ with uv package manager' while the registry metadata lists no required binaries—an inconsistency between claimed capabilities and declared requirements.
!
Instruction Scope
The runtime instructions and seed.yaml embed operational directives: preconditions that run python -c 'import zvt' checks, instructions to run pip install zvt and zvt.init_dirs on failure, references to ZVT_HOME and file-system write tests, and a required read/reload of seed.yaml before decisions. Those precondition commands and the requirement to run recorders/backtests grant the agent (or the user following its guidance) the ability to install packages and touch local directories. The SKILL.md also enforces semantic locks that affect trading behavior (fatal halts). While there is no explicit exfiltration or remote endpoint, the instructions reach into system state (installed packages, env var ZVT_HOME, filesystem) that were not declared in the skill metadata.
Install Mechanism
No install spec and no code files are present (instruction-only), which reduces risk from arbitrary downloads or archives. That said, SKILL.md and seed.yaml expect host environment preparation (Python 3.12+, uv package manager) and runtime preconditions may prompt/require the user to pip-install zvt. The absence of an install block is coherent with an instruction-only skill, but the documented runtime dependency on zvt is not reflected in registry 'required binaries', worth clarifying.
!
Credentials
Registry metadata declares no required environment variables or credentials, but SKILL.md and seed.yaml reference ZVT_HOME and preconditions attempt to read/write ~/.zvt. The user-prompted choices include data providers (eastmoney, joinquant, qmt/broker) that normally require API credentials; yet the skill does not declare or request any provider credentials. This mismatch (references to env/config and potential broker APIs without declared env requirements) is disproportionate and should be explained before use. There is no explicit credential-exfiltration code, but the skill could lead the user to connect third-party providers or run recorders that require secrets.
Persistence & Privilege
always:false and no install spec — the skill does not request forced inclusion or persistent autonomous installation. seed.yaml does instruct agents to re-read the authoritative seed.yaml before decisions and to run preconditions at execution time; this is behavioural control within the skill but not a platform-level persistence/privilege escalation. No evidence the skill modifies other skills or system-wide settings beyond advising package installs and filesystem checks.
What to consider before installing
This skill mixes credit-transition-matrix material with trading/backtest instructions and host-environment checks; before installing or using it: 1) Ask the author to clarify scope — is this meant to only compute transition matrices or also to run backtests/trading? 2) Confirm required runtime dependencies (Python version, uv package manager, zvt) and whether the skill will prompt you to pip-install packages or run recorders that touch ~/.zvt. 3) Never provide broker/API credentials until you understand where they will be stored or transmitted — the skill references providers (joinquant, qmt) but declares no credential handling. 4) If you plan to run any commands it suggests, do so in a sandbox or non-production environment and inspect any pip installs and the contents of references/seed.yaml first. 5) If you need a conservative decision: treat this as a combined credit-and-trading blueprint and request a pared-down variant focused only on transition-matrix computations (with explicit declared dependencies and no trading_execution directives). Additional information that would change this assessment: explicit author/source, a clear mapping of which parts perform only matrix estimations vs trading, and alignment between SKILL.md declared dependencies and the registry metadata.

Like a lobster shell, security has layers — review code before you run it.

creditvk970f0f7132tmdph1q7dz97fk185cr7wdatavk970f0f7132tmdph1q7dz97fk185cr7wdoramagic-crystalvk970f0f7132tmdph1q7dz97fk185cr7wfinancevk970f0f7132tmdph1q7dz97fk185cr7wlatestvk970f0f7132tmdph1q7dz97fk185cr7wriskvk970f0f7132tmdph1q7dz97fk185cr7w
63downloads
0stars
4versions
Updated 3d ago
v0.3.3
MIT-0

信用转移矩阵 (credit-transition-matrix)

处理信用评级转移矩阵,支持Not-Rated状态重分配、年度与月度矩阵转换、状态空间定义及数据集表征。

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (22 total)

Adjust Not-Rated State in Credit Migration Matrices (UC-101)

Credit rating transition matrices often contain 'not-rated' (NR) observations that need to be redistributed to rated states for downstream risk calcul Triggers: not-rated, NR adjustment, credit migration

Adjust Not-Rated State via Python Script (UC-104)

Corporate credit rating migration data contains NR (not-rated) states that must be removed using noninformative redistribution method before calculati Triggers: not-rated, NR removal, credit rating

Clean and Prepare Transition Data (UC-108)

Raw credit rating data requires preprocessing including column renaming, state validation, and absorbing state verification before it can be used for Triggers: data cleaning, preprocessing, validation

For all 22 use cases, see references/USE_CASES.md.

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

  • Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
  • Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
  • Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
  • Time range: start_timestamp and end_timestamp for backtest period
  • Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

IDRuleOn Violation
SL-01Execute sell orders before buy orders in every trading cyclehalt
SL-02Trading signals MUST use next-bar execution (no look-ahead)halt
SL-03Entity IDs MUST follow format entity_type_exchange_codehalt
SL-04DataFrame index MUST be MultiIndex (entity_id, timestamp)halt
SL-05TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amounthalt
SL-06filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTIONhalt
SL-07Transformer MUST run BEFORE Accumulator in factor pipelinehalt
SL-08MACD parameters locked: fast=12, slow=26, signal=9halt

Full lock definitions: references/LOCKS.md

Top Anti-Patterns (14 total)

  • AP-CREDIT-RISK-001: Empty DataFrame passed to bucketing pipeline
  • AP-CREDIT-RISK-002: Multi-dimensional target array causing WoE shape mismatch
  • AP-CREDIT-RISK-003: OptimalBucketer receiving high-cardinality numerical features

All 14 anti-patterns: references/ANTI_PATTERNS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-119. Evidence verify ratio = 35.8% and audit fail total = 15. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

FileContentsWhen to Load
references/seed.yamlV6+ 全量权威 (source-of-truth)有行为/决策争议时必读
references/ANTI_PATTERNS.md14 条跨项目反模式开始实现前
references/WISDOM.md跨项目精华借鉴架构决策时
references/CONSTRAINTS.mddomain + fatal 约束规则冲突时
references/USE_CASES.md全量 KUC-* 业务场景需要完整示例时
references/LOCKS.mdSL-* + preconditions + hints生成回测/交易代码前
references/COMPONENTS.mdAST 组件地图(按 module 拆分)查 API 时

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-119 blueprint at 2026-04-22T13:00:58.228711+00:00. See human_summary.md for non-technical overview.

Comments

Loading comments...