Ledger Plaintext Accounting

通过字节码驱动的复式记账引擎，支持多币种账户余额实时查询和资金来源的FIFO分配追踪。

Security Scan

The skill's docs and runtime instructions reference Python packages, a host-specific runtime (zvt), an environment variable (ZVT_HOME) and external data providers that would normally require installs/credentials, but the skill declares no install steps or required credentials — these mismatches are suspicious and need clarification before use.

Purpose & Capability

Name/description focus on a bytecode-driven ledger and FIFO allocation tracking (accounting), but the SKILL.md and seed.yaml also describe a full data -> backtest -> trading_execution pipeline (ZVT, recorders, trading signals). That can be coherent for an accounting+backtest tool, but the skill does not declare the runtime dependencies it uses (Python 3.12+, zvt, uv package manager) nor any credentials for external data providers mentioned (joinquant, qmt). The absence of declared dependencies/credentials is disproportionate to what the instructions indicate is required.

Instruction Scope

SKILL.md/seed.yaml direct the agent to run preconditions that execute Python commands, check/import zvt, run zvt.recorders, and read/write files under ZVT_HOME. The execution_protocol requires re-reading seed.yaml before decisions and running host install recipes. These instructions access environment state and may invoke pip installs or recorders — actions beyond a simple 'plaintext ledger' description. The skill also references external data providers (some requiring accounts) without declaring how credentials will be provided.

Install Mechanism

There is no declared install spec (instruction-only), which reduces direct installer risk. However, seed.yaml and SKILL.md explicitly expect host installs and even suggest running pip install zvt if preconditions fail. That mismatch (no install step declared but instructions tell the agent to install/verify packages) is a procedural inconsistency and could cause the agent to attempt network installs at runtime.

Credentials

The registry metadata lists no required environment variables or credentials, but SKILL.md/LOCKS/preconditions reference ZVT_HOME and commands that rely on installed packages and possibly provider accounts (joinquant, qmt). Data providers listed commonly require API keys/accounts; those are not declared. Instructions read environment variables not listed (ZVT_HOME) and propose writing test files in user directories — this is disproportionate and under-specified.

Persistence & Privilege

always is false and the skill is user-invocable with normal autonomous invocation enabled. The skill does not request persistent platform privileges or claim to modify other skills. The seed.yaml rule that agents should re-read seed.yaml is an instruction-level policy, not a granted platform privilege. This is potentially invasive behavior-wise (forcing repeated reads) but not a declared privilege escalation.

What to consider before installing

This skill's documentation expects a Python/ZVT runtime, filesystem access (ZVT_HOME), and connections to external data providers, but the package/credential requirements are not declared. Before installing or running it: 1) Ask the author to provide a clear manifest listing required Python version, packages (with exact sources), and any environment variables or API keys the skill will use. 2) Do not supply credentials (joinquant/qmt/etc.) until the skill explicitly documents why and how they'll be used and stored. 3) Run the skill first in an isolated/sandbox environment where pip installs and file writes cannot affect your main system. 4) If you must run it on a production host, restrict the agent's network and filesystem access, and prefer manual installation of dependencies from known, auditable sources. 5) Because the source is 'unknown' and license is proprietary, prefer requesting source provenance or a signed release from the maintainer before trusting it with sensitive data or credentials.

Ledger 纯文本记账 (ledger-plaintext-accounting)

通过字节码驱动的复式记账引擎，支持多币种账户余额实时查询和资金来源的FIFO分配追踪。

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (0 total)

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

• Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
• Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
• Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
• Time range: start_timestamp and end_timestamp for backtest period
• Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

ID	Rule	On Violation
SL-01	Execute sell orders before buy orders in every trading cycle	halt
SL-02	Trading signals MUST use next-bar execution (no look-ahead)	halt
SL-03	Entity IDs MUST follow format entity_type_exchange_code	halt
SL-04	DataFrame index MUST be MultiIndex (entity_id, timestamp)	halt
SL-05	TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amount	halt
SL-06	filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTION	halt
SL-07	Transformer MUST run BEFORE Accumulator in factor pipeline	halt
SL-08	MACD parameters locked: fast=12, slow=26, signal=9	halt

Full lock definitions: references/LOCKS.md

Top Anti-Patterns (15 total)

• AP-ACCOUNTING-001: Using floating-point arithmetic for monetary amounts
• AP-ACCOUNTING-002: Skipping initialization calls before VM/script execution
• AP-ACCOUNTING-003: Mixing different asset types in monetary operations

All 15 anti-patterns: references/ANTI_PATTERNS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-073. Evidence verify ratio = 85.9% and audit fail total = 0. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

File	Contents	When to Load
references/seed.yaml	V6+ 全量权威 (source-of-truth)	有行为/决策争议时必读
references/ANTI_PATTERNS.md	15 条跨项目反模式	开始实现前
references/WISDOM.md	跨项目精华借鉴	架构决策时
references/CONSTRAINTS.md	domain + fatal 约束	规则冲突时
references/USE_CASES.md	全量 KUC-* 业务场景	需要完整示例时
references/LOCKS.md	SL-* + preconditions + hints	生成回测/交易代码前
references/COMPONENTS.md	AST 组件地图（按 module 拆分）	查 API 时

---

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-073 blueprint at 2026-04-22T13:00:26.836559+00:00. See human_summary.md for non-technical overview.