Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

insurance-actuarial-python

v0.3.0

使用奇异谱分析和平稳自助法对利率时间序列进行分解与统计推断,构建 NSS 曲线模型并校准利率衍生品参数。触发场景:(1) 用户要对互换利率数据进行趋势分解和季节性分析;(2) 用户要对利率曲线模型进行参数校准和置信区间估计;(3) 用户要对保险负债进行久期匹配和利率敏感性分析。

0· 18·0 current·0 all-time
byTang Weigang@tangweigang-jpg
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
Name/description claim actuarial functionality (SSA, stationary bootstrap, NSS curve calibration). However SKILL.md's top-level content and prompts primarily describe an end-to-end ZVT trading/backtest pipeline for A-share (MACD, data providers like eastmoney, joinquant) including trading 'semantic locks'. While some reference files describe actuarial components, the user-facing instructions are strongly oriented to stock backtesting. This mismatch between stated purpose and the actionable instructions is unexpected and unexplained.
!
Instruction Scope
Runtime instructions require running scripts/install.sh, re-reading seed.yaml and many reference documents, and running precondition checks that execute python -c commands against zvt and check/write the ZVT_HOME directory. Those filesystem and package checks are plausible for a ZVT pipeline but are not clearly required by the actuarial description. The skill does not request external credentials, but it does instruct the agent to read/modify local paths (ZVT_HOME, create/write test files) and to run arbitrary python import checks—this is within scope for a data pipeline but inconsistent with the insurance-actuarial label.
!
Install Mechanism
Install is an instruction-only skill but ships scripts/install.sh which runs a sequence of pip install commands without pinned versions. Notably it attempts to pip install 'datetime' and 'warnings' — modules that are part of the Python standard library and normally should not be installed via pip. Installing unpinned packages (and packages that shadow stdlib names) is risky and may install unexpected or malicious packages. The rest of the packages are common scientific libs (numpy, scipy, pandas, matplotlib, seaborn, pytest, IPython) which are consistent with either actuarial work or data analysis, but lack of version pins and the presence of stdlib-named packages are red flags.
!
Credentials
The declared requirements list no environment variables or credentials. However SKILL.md and references include preconditions that read ZVT_HOME and run zvt import/recorder checks, which implicitly require filesystem access and possibly network access to data providers. Those precondition checks are proportionate if the skill is a ZVT backtester, but are not justified by the top-level actuarial description. No API keys are requested explicitly.
Persistence & Privilege
The skill does not request 'always: true' or any elevated platform privileges. It does instruct creating/checking a ZVT home directory and touching a test file (precondition PC-04), which is normal for initializing a data workspace. It does not appear to modify other skills' configurations or ask for long-term platform-level persistence.
Scan Findings in Context
[AP-INSURANCE-005] expected: References include EIOPA/Smith-Wilson calibration anti-patterns (AP-INSURANCE-005). Presence in documentation signals the blueprint is aware of calibration pitfalls; it's not a code-level finding but a risk to verify in implementations.
[AP-INSURANCE-006] expected: Anti-pattern AP-INSURANCE-006 (missing iteration bounds causing infinite loops) is present in the project's anti-pattern docs. This is relevant to root-finding/calibration components described in the references and should be checked in actual code.
[AP-INSURANCE-001] expected: AP-INSURANCE-001 (implicit numeric format assumptions) appears in the anti-pattern list. This is a domain correctness concern to audit in numerical routines; its presence in docs is expected for an actuarial blueprint.
What to consider before installing
Do not run the install script or execute the skill until you validate a few things: 1) Clarify purpose with the author — the SKILL.md is primarily a ZVT stock/backtest flow while the skill name/description claims actuarial interest-rate work. If you expected actuarial-only functionality, this mismatch is a red flag. 2) Inspect scripts/install.sh before running. It attempts pip installs without version pins and tries to install 'datetime' and 'warnings' (stdlib names) which is suspicious and may fail or pull unexpected packages. Remove or pin dependencies and remove stdlib-named installs. 3) Review preconditions that touch your filesystem (ZVT_HOME) and any python commands that will import/initialize zvt — run these in an isolated sandbox or container first. 4) Audit numerical routines for the anti-patterns listed (AP-INSURANCE-001, AP-INSURANCE-005, AP-INSURANCE-006) before using results for important decisions. If you can't verify these, prefer a vetted package or ask the publisher for a clear, consistent SKILL.md and a safe, pinned install manifest.

Like a lobster shell, security has layers — review code before you run it.

doramagic-crystalvk97bfxvtv8cjww15ads3wxms1585b1k8financevk97bfxvtv8cjww15ads3wxms1585b1k8latestvk97bfxvtv8cjww15ads3wxms1585b1k8
18downloads
0stars
1versions
Updated 5h ago
v0.3.0
MIT-0

insurance-actuarial-python

I help you build quant strategies on A-share with ZVT — from data fetch to backtest, one flow. Just tell me what you want; I'll write the code, you don't have to dig docs. (Heads up: ZVT natively supports A-share, HK, and crypto. US stocks — stockus_nasdaq_AAPL — are half-baked; don't bother for serious work.)

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (2 total)

Singular Spectrum Analysis Time Series Decomposition (UC-101)

Decomposes time series data into interpretable components (trend, seasonality, noise) using Singular Spectrum Analysis to identify underlying patterns Triggers: SSA, singular spectrum analysis, time series decomposition

Stationary Bootstrap for Interest Rate Swap Inference (UC-102)

Applies stationary bootstrap resampling method to Italian swap rate data for statistical inference, enabling confidence interval estimation and hypoth Triggers: stationary bootstrap, swap rates, resampling

Install

# One-time setup before first use
bash scripts/install.sh

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

  • Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
  • Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
  • Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
  • Time range: start_timestamp and end_timestamp for backtest period
  • Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

IDRuleOn Violation
SL-01Execute sell orders before buy orders in every trading cyclehalt
SL-02Trading signals MUST use next-bar execution (no look-ahead)halt
SL-03Entity IDs MUST follow format entity_type_exchange_codehalt
SL-04DataFrame index MUST be MultiIndex (entity_id, timestamp)halt
SL-05TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amounthalt
SL-06filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTIONhalt
SL-07Transformer MUST run BEFORE Accumulator in factor pipelinehalt
SL-08MACD parameters locked: fast=12, slow=26, signal=9halt

Full lock definitions: references/LOCKS.md

Top Anti-Patterns (15 total)

  • AP-INSURANCE-001: Implicit numeric format assumptions without validation
  • AP-INSURANCE-002: Triangle axis construction with invalid temporal ordering
  • AP-INSURANCE-003: Cumulative/incremental triangle representation misuse

All 15 anti-patterns: references/ANTI_PATTERNS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-064. Evidence verify ratio = 11.6% and audit fail total = 40. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

FileContentsWhen to Load
references/seed.yamlV6+ 全量权威 (source-of-truth)有行为/决策争议时必读
references/ANTI_PATTERNS.md15 条跨项目反模式开始实现前
references/WISDOM.md跨项目精华借鉴架构决策时
references/CONSTRAINTS.mddomain + fatal 约束规则冲突时
references/USE_CASES.md全量 KUC-* 业务场景需要完整示例时
references/LOCKS.mdSL-* + preconditions + hints生成回测/交易代码前
references/COMPONENTS.mdAST 组件地图(按 module 拆分)查 API 时

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-064 blueprint at 2026-04-22T13:00:20.990803+00:00. See human_summary.md for non-technical overview.

Comments

Loading comments...