Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Ml4t Book Notebooks

v0.3.3

基于《Machine Learning for Trading》第二版配套 notebooks 实现量化交易策略开发与回测,涵盖多市场金融数据的时间序列机器学习分析。

0· 93·0 current·0 all-time
byTang Weigang@tangweigang-jpg

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for tangweigang-jpg/ml4t-book-notebooks.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Ml4t Book Notebooks" (tangweigang-jpg/ml4t-book-notebooks) from ClawHub.
Skill page: https://clawhub.ai/tangweigang-jpg/ml4t-book-notebooks
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install ml4t-book-notebooks

ClawHub CLI

Package manager switcher

npx clawhub@latest install ml4t-book-notebooks
Security Scan
Capability signals
CryptoRequires walletRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description, included references (components, locks, anti-patterns) and the SKILL.md all consistently describe a Machine Learning for Trading notebook/workflow (zvt-based pipeline). Nothing in the files claims unrelated capabilities (no unexpected cloud or secret access requested).
!
Instruction Scope
SKILL.md and seed.yaml contain explicit runtime preconditions that expect the host to run Python checks and pip actions (e.g., `python3 -c 'import zvt'`, instructions to `pip install zvt`, and `python3 -m zvt.init_dirs`) and to create/check ~/.zvt. Those actions will read/write local filesystem and may install packages — reasonable for this kind of notebook, but the registry metadata declared no required binaries or install steps, so the runtime scope is under-declared.
Install Mechanism
This is an instruction-only skill (no install spec, no code files). That's lower risk. However SKILL.md claims "Requires Python 3.12+ with uv package manager" while the manifest lists no required binaries and no install recipe — mismatch. Also 'uv package manager' is not a common/default manager on many hosts and may indicate a typo or an undocumented dependency; the skill does advise installing zvt via pip in preconditions but does not ship a formal install recipe.
Credentials
The skill declares no required environment variables or credentials and the files do not ask for tokens or secrets. It does reference ZVT_HOME and suggests creating/checking ~/.zvt via precondition checks — appropriate for a local data directory but worth noting that the skill will access home-directory paths.
Persistence & Privilege
Default invocation/persistence flags are normal (always:false, agent-autonomy allowed). The seed.yaml execution_protocol instructs the host/agent to re-read seed.yaml and run preconditions before executing — this gives the skill broad runtime control over checking/installing local packages and directories, which is expected for a heavy notebook workflow but is not reflected in the registry install metadata.
What to consider before installing
This package appears to be a collection of docs/blueprints for zvt-based quant notebooks and is internally consistent with that purpose. Before you run it: 1) Confirm your environment has Python 3.12+ (the manifest did not declare it) and clarify what the author means by the "uv" package manager (may be a typo or an undocumented requirement). 2) Inspect seed.yaml and the LOCKS.md/PC-* preconditions — the skill expects to run local Python checks, may call pip to install zvt and will create/check ~/.zvt (writes to your home). If you don't want packages installed or dirs created automatically, do not run the automated preconditions; instead manually review and run only the commands you trust. 3) There are no requested credentials, but verify there is no hidden code (this is instruction-only here, but if you later download code or run commands that fetch code, inspect those sources). 4) If you plan to use real brokers or execution paths, audit any later code that performs network or order execution — this skill enforces strong semantic locks (e.g., no look-ahead, T+1 rules) that will affect trading behavior. If any of the above is unclear, treat the skill as untrusted until you can verify the exact runtime commands and dependencies.

Like a lobster shell, security has layers — review code before you run it.

a-sharevk977sv60w812jg9g91zswtjehn85dqqsdatavk977sv60w812jg9g91zswtjehn85dqqsdoramagic-crystalvk977sv60w812jg9g91zswtjehn85dqqsfinancevk977sv60w812jg9g91zswtjehn85dqqslatestvk977sv60w812jg9g91zswtjehn85dqqsquantvk977sv60w812jg9g91zswtjehn85dqqstradingvk977sv60w812jg9g91zswtjehn85dqqs
93downloads
0stars
3versions
Updated 4d ago
v0.3.3
MIT-0

ML4T 交易教程 (ml4t-book-notebooks)

基于《Machine Learning for Trading》第二版配套 notebooks 实现量化交易策略开发与回测,涵盖多市场金融数据的时间序列机器学习分析。

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (0 total)

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

  • Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
  • Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
  • Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
  • Time range: start_timestamp and end_timestamp for backtest period
  • Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

IDRuleOn Violation
SL-01Execute sell orders before buy orders in every trading cyclehalt
SL-02Trading signals MUST use next-bar execution (no look-ahead)halt
SL-03Entity IDs MUST follow format entity_type_exchange_codehalt
SL-04DataFrame index MUST be MultiIndex (entity_id, timestamp)halt
SL-05TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amounthalt
SL-06filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTIONhalt
SL-07Transformer MUST run BEFORE Accumulator in factor pipelinehalt
SL-08MACD parameters locked: fast=12, slow=26, signal=9halt

Full lock definitions: references/LOCKS.md

Top Anti-Patterns (15 total)

  • AP-TIME-SERIES-ML-001: TimeSeries values array dimensionality mismatch
  • AP-TIME-SERIES-ML-002: Non-floating-point dtype in TimeSeries values
  • AP-TIME-SERIES-ML-003: Irregular or non-monotonic time index

All 15 anti-patterns: references/ANTI_PATTERNS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-121. Evidence verify ratio = 31.8% and audit fail total = 35. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

FileContentsWhen to Load
references/seed.yamlV6+ 全量权威 (source-of-truth)有行为/决策争议时必读
references/ANTI_PATTERNS.md15 条跨项目反模式开始实现前
references/WISDOM.md跨项目精华借鉴架构决策时
references/CONSTRAINTS.mddomain + fatal 约束规则冲突时
references/USE_CASES.md全量 KUC-* 业务场景需要完整示例时
references/LOCKS.mdSL-* + preconditions + hints生成回测/交易代码前
references/COMPONENTS.mdAST 组件地图(按 module 拆分)查 API 时

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-121 blueprint at 2026-04-22T13:00:59.543591+00:00. See human_summary.md for non-technical overview.

Comments

Loading comments...