Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Gs Quant Pricing

v0.3.3

提供年化波动率、指数加权移动平均(EMA)和指数加权标准差等量化金融指标的专业计算能力,支持维度枚举到字符串的灵活覆盖,适用于金融时间序列分析与资产定价建模。

0· 98·0 current·0 all-time
byTang Weigang@tangweigang-jpg

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for tangweigang-jpg/gs-quant-pricing.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Gs Quant Pricing" (tangweigang-jpg/gs-quant-pricing) from ClawHub.
Skill page: https://clawhub.ai/tangweigang-jpg/gs-quant-pricing
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install gs-quant-pricing

ClawHub CLI

Package manager switcher

npx clawhub@latest install gs-quant-pricing
Security Scan
Capability signals
Crypto
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The name/description match a quant analytics/backtesting skill (ZVT/ZVT-like pipeline). However SKILL.md explicitly states it requires Python 3.12+ and an 'uv' package manager and references zvt, Marquee/Goldman APIs and other data providers. The registry metadata declares no required binaries, no env vars, and no install steps — a mismatch. Asking for access to market-data providers and local ZVT home directories is coherent with the stated purpose, but the skill should have declared Python and provider credentials up-front.
!
Instruction Scope
Runtime instructions require reading several embedded reference files (seed.yaml, LOCKS.md, etc.), reloading seed.yaml on each decision, running precondition checks that invoke python3 commands, and may instruct the user/agent to run 'pip install zvt' or data recorders that contact external providers. Those actions stay within a quant-workflow scope but the instructions also assume filesystem write access (~/.zvt), network access to external data providers, and possible package installation — none of which are declared. The SKILL.md mandates semantic locks and strict preconditions (fatal halts) that the agent must enforce, which increases the operational surface.
Install Mechanism
This is instruction-only with no formal install spec (lowest installer risk). Nevertheless SKILL.md and seed.yaml reference installing Python packages (e.g., pip install zvt) and expect the host to have Python 3.12+ and 'uv' package manager. Because installs are left to runtime commands (not a curated install recipe), there is moderate operational risk from pulling third-party packages at run time, but no direct download URLs or archive extraction are present in the skill bundle.
!
Credentials
Registry lists no required environment variables or credentials, yet SKILL.md/preconditions reference ZVT_HOME, and data-provider choices (joinquant, Marquee/GS APIs, qmt, etc.) will typically require API keys/accounts. The skill also expects read/write access to a local data directory (~/.zvt) and may prompt users to run recorders that use network credentials. The absence of declared env vars/credentials is disproportionate to the functionality described.
Persistence & Privilege
The skill does not request always:true and does not attempt to modify other skills or system-wide configurations. Autonomous invocation is allowed (default) but not exceptional here. The skill's expectations of re-reading seed.yaml and running preconditions are internal to the skill bundle and do not imply elevated platform privileges beyond typical agent operation.
What to consider before installing
This skill is a coherent quant/backtest blueprint but has important gaps and assumptions. Before installing or running it: 1) Confirm your environment: the skill expects Python 3.12+, an 'uv' package manager, and the zvt library (it may suggest 'pip install zvt'); be prepared to run package installs. 2) Prepare credentials only for the data providers you plan to use (joinquant, Marquee/GS, eastmoney, qmt, etc.) — the skill does not declare these env vars but its workflow requires them. 3) Be aware it expects writable local data directories (default ~/.zvt) and will read embedded reference files (seed.yaml, LOCKS.md) that influence behavior; consider running in an isolated container/VM. 4) Review the proprietary license and the included seed.yaml/LOCKS.md for constraints (semantic locks are 'fatal' for some rules). 5) If you need to allow package installs or network access, restrict them to a sandbox and only provide credentials you expect to expose. The inconsistencies between declared requirements and runtime instructions justify caution; ask the maintainer to (a) declare required binaries/env vars, (b) provide a reproducible install recipe, and (c) document which external credentials are needed and why.

Like a lobster shell, security has layers — review code before you run it.

datavk9710mzdndx021rg8bk3452c0s85dpszdoramagic-crystalvk9710mzdndx021rg8bk3452c0s85dpszfinancevk9710mzdndx021rg8bk3452c0s85dpszlatestvk9710mzdndx021rg8bk3452c0s85dpszquantvk9710mzdndx021rg8bk3452c0s85dpszriskvk9710mzdndx021rg8bk3452c0s85dpsz
98downloads
0stars
3versions
Updated 4d ago
v0.3.3
MIT-0

GS Quant 风险定价 (gs-quant-pricing)

提供年化波动率、指数加权移动平均(EMA)和指数加权标准差等量化金融指标的专业计算能力,支持维度枚举到字符串的灵活覆盖,适用于金融时间序列分析与资产定价建模。

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (0 total)

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

  • Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
  • Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
  • Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
  • Time range: start_timestamp and end_timestamp for backtest period
  • Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

IDRuleOn Violation
SL-01Execute sell orders before buy orders in every trading cyclehalt
SL-02Trading signals MUST use next-bar execution (no look-ahead)halt
SL-03Entity IDs MUST follow format entity_type_exchange_codehalt
SL-04DataFrame index MUST be MultiIndex (entity_id, timestamp)halt
SL-05TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amounthalt
SL-06filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTIONhalt
SL-07Transformer MUST run BEFORE Accumulator in factor pipelinehalt
SL-08MACD parameters locked: fast=12, slow=26, signal=9halt

Full lock definitions: references/LOCKS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-020. Evidence verify ratio = 57.7% and audit fail total = 4. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

FileContentsWhen to Load
references/seed.yamlV6+ 全量权威 (source-of-truth)有行为/决策争议时必读
references/ANTI_PATTERNS.md0 条跨项目反模式开始实现前
references/WISDOM.md跨项目精华借鉴架构决策时
references/CONSTRAINTS.mddomain + fatal 约束规则冲突时
references/USE_CASES.md全量 KUC-* 业务场景需要完整示例时
references/LOCKS.mdSL-* + preconditions + hints生成回测/交易代码前
references/COMPONENTS.mdAST 组件地图(按 module 拆分)查 API 时

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-020 blueprint at 2026-04-22T13:00:16.803564+00:00. See human_summary.md for non-technical overview.

Comments

Loading comments...