Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

pandas-ta-indicators

v0.3.0

基于 pandas-ta 库计算技术分析指标(RSI、MACD、布林带、KAMA 等),支持多市场数据可视化与自定义参数调整。 触发场景:(1) 用户要计算某只股票的 RSI、MACD 等指标数值;(2) 用户要绘制布林带或其他技术分析图表观察价格波动;(3) 用户要快速获取多指标结果或导出到其他平台使用。

0· 30·0 current·0 all-time
byTang Weigang@tangweigang-jpg
Security Scan
Capability signals
Crypto
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill name/description promises 'pandas-ta' technical indicators, but the SKILL.md repeatedly references ZVT/finance blueprints and TA-python artifacts. The included install script does not install pandas-ta or ZVT/recorders; instead it installs general data packages (pandas, numpy, scipy, scikit-learn, pytest). Declared runtime requirement 'Python 3.12+ with uv package manager' conflicts with an install.sh that uses python3 pip. Several installed packages (scikit-learn, pytest) seem unnecessary for a runtime indicator computation skill. These mismatches suggest sloppy packaging or incomplete wiring rather than a coherent, minimal toolchain for the stated purpose.
!
Instruction Scope
SKILL.md instructs running scripts/install.sh and then running precondition checks that call python commands to import zvt and access local data directories, and to write/read ~/.zvt. It also instructs the agent to reload seed.yaml and to cite many internal anti-patterns and wisdom documents. The instructions reference the ZVT_HOME environment variable and expect running recorders and network data fetchers (eastmoney/joinquant/akshare). Those environment variables and external data-provider credentials are not declared in the skill manifest. The runtime instructions therefore require filesystem access, running arbitrary python commands, and potential network access to external data providers — all out-of-band relative to the manifest.
Install Mechanism
No formal install spec in registry, but the bundle includes scripts/install.sh which runs pip installs for pinned/inequality package versions. Installing from PyPI is common and lower risk than arbitrary downloads, but the script does not install key expected components (pandas-ta, zvt, or ta-lib) and contradicts the declared 'uv package manager' + Python 3.12 requirement. The packages pinned may also have version incompatibilities with the target Python version. Overall: expected install mechanism (pip), but content is incomplete/misaligned.
!
Credentials
The manifest lists no required environment variables or credentials, yet SKILL.md and references use ZVT_HOME and discuss data providers that typically require credentials (joinquant/qmt). The preconditions explicitly check ZVT presence and writable ~/.zvt, but ZVT_HOME was not declared in requires.env. This is a mismatch: the skill will read/write local config paths and may prompt for external API credentials while declaring zero environment/secret requirements.
Persistence & Privilege
The skill is not 'always: true' and is user-invocable with autonomous invocation allowed (platform default). It does not request to modify other skills or system-wide settings in the manifest. The seed.yaml execution protocol asks the host to reload seed.yaml at runtime, which is normal for complex skill artifacts, but does not by itself indicate excessive privilege.
Scan Findings in Context
[AP-TECHNICAL-ANALYSIS-003] expected: SKILL references TA/FFI and anti-patterns that include 'Ignoring TA_RetCode' — relevant to implementing TA libraries and expected for a technical-analysis skill. Presence signals the project documents known C-FFI failure modes but does not imply maliciousness.
[AP-TECHNICAL-ANALYSIS-005] expected: Time-series reindexing and alignment rules are present in anti-patterns/constraints; these are expected and appropriate for a backtest/TA skill.
[AP-TECHNICAL-ANALYSIS-006] expected: Data cleaning (NaN/Inf/Zero) anti-pattern is flagged in references — expected for indicator computation and worth attention when using the skill.
[AP-TECHNICAL-ANALYSIS-008] expected: A warning about 'False Claims: Indicator Calculation as Trading Signal' appears in the anti-patterns; appropriate to caution users not to treat historical indicators as guaranteed signals.
What to consider before installing
This package appears to be a domain-rich TA/backtest 'crystal' but is internally inconsistent: the README talks about ZVT and TA-blueprints while the install script only pip-installs pandas/numpy/scipy/etc and omits pandas-ta or zvt. Before installing or running it: (1) Ask the publisher which runtime is required (Python version, uv vs pip) and request a corrected install script that installs the actual runtime packages (pandas-ta, zvt, ta-lib bindings if needed). (2) Verify any environment variables (ZVT_HOME) and whether you'll need API credentials for data providers (joinquant, eastmoney) — these are referenced but not declared. (3) Run the install inside an isolated virtualenv or sandbox. (4) Review seed.yaml / SKILL.md and the included scripts for any unexpected network endpoints or commands. If you cannot get clarifications, treat it as untrusted and avoid granting it broad access to production data/credentials.

Like a lobster shell, security has layers — review code before you run it.

doramagic-crystalvk97dt4gvmbz7k655k2b1mfa90x85dgt2financevk97dt4gvmbz7k655k2b1mfa90x85dgt2latestvk97dt4gvmbz7k655k2b1mfa90x85dgt2
30downloads
0stars
1versions
Updated 10h ago
v0.3.0
MIT-0

pandas-ta-indicators

I help you build quant strategies on A-share with ZVT — from data fetch to backtest, one flow. Just tell me what you want; I'll write the code, you don't have to dig docs. (Heads up: ZVT natively supports A-share, HK, and crypto. US stocks — stockus_nasdaq_AAPL — are half-baked; don't bother for serious work.)

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (2 total)

Sphinx Documentation Configuration (UC-101)

Configures the Sphinx documentation builder for the Technical Analysis Library, enabling automated generation of API documentation Triggers: documentation, sphinx, config

Technical Analysis Features Visualization (UC-102)

Explores and visualizes various technical analysis indicators (Bollinger Bands, Keltner Channel, Donchian Channel, MACD) on historical price data to u Triggers: visualize, technical indicators, charting

Install

# One-time setup before first use
bash scripts/install.sh

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

  • Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
  • Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
  • Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
  • Time range: start_timestamp and end_timestamp for backtest period
  • Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

IDRuleOn Violation
SL-01Execute sell orders before buy orders in every trading cyclehalt
SL-02Trading signals MUST use next-bar execution (no look-ahead)halt
SL-03Entity IDs MUST follow format entity_type_exchange_codehalt
SL-04DataFrame index MUST be MultiIndex (entity_id, timestamp)halt
SL-05TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amounthalt
SL-06filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTIONhalt
SL-07Transformer MUST run BEFORE Accumulator in factor pipelinehalt
SL-08MACD parameters locked: fast=12, slow=26, signal=9halt

Full lock definitions: references/LOCKS.md

Top Anti-Patterns (15 total)

  • AP-TECHNICAL-ANALYSIS-001: C FFI Type Mismatch with Non-float64 Arrays
  • AP-TECHNICAL-ANALYSIS-002: Multidimensional Array Memory Access Violations
  • AP-TECHNICAL-ANALYSIS-003: Ignoring TA_RetCode Error Status from C Calls

All 15 anti-patterns: references/ANTI_PATTERNS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-122. Evidence verify ratio = 72.5% and audit fail total = 34. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

FileContentsWhen to Load
references/seed.yamlV6+ 全量权威 (source-of-truth)有行为/决策争议时必读
references/ANTI_PATTERNS.md15 条跨项目反模式开始实现前
references/WISDOM.md跨项目精华借鉴架构决策时
references/CONSTRAINTS.mddomain + fatal 约束规则冲突时
references/USE_CASES.md全量 KUC-* 业务场景需要完整示例时
references/LOCKS.mdSL-* + preconditions + hints生成回测/交易代码前
references/COMPONENTS.mdAST 组件地图(按 module 拆分)查 API 时

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-122 blueprint at 2026-04-22T13:01:00.198579+00:00. See human_summary.md for non-technical overview.

Comments

Loading comments...