Py Vollib Options Pricing
Security checks across malware telemetry and agentic risk
Overview
The skill is advertised as py-vollib options pricing, but its instructions largely steer the agent toward unrelated ZVT market-data, backtesting, and trading workflows.
Review this skill carefully before installing. It may be useful as finance reference material, but the current artifacts do not coherently match the advertised options-pricing purpose; avoid letting it run setup, data-recorder, broker, or trading-related actions unless you explicitly intended that broader ZVT workflow.
VirusTotal
66/66 vendors flagged this skill as clean.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user expecting option-pricing calculations could instead have the agent produce or run broader trading/backtesting workflows.
The skill presents itself as an options-pricing helper, but its workflow and questions point to market-data collection, target selection, and trading execution for ZVT-style quant strategies.
description: 使用 BSM 和 Black 模型对欧式期权进行定价和 Greeks 计算 ... Pipeline `data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization` ... Target market: A-share (default), HK, or crypto?
Treat the skill as mismatched until the publisher removes the unrelated ZVT/trading material or clearly republishes it as a trading/backtesting skill with explicit limits.
If an agent follows these instructions too broadly, it may modify the local Python environment and create/fill market-data directories for an unrelated workflow.
The skill documents local package installation, persistent ZVT initialization, and market-data recorder commands, which are not clearly justified by the stated py-vollib options-pricing purpose.
PC-01: `python3 -c 'import zvt; print(zvt.__version__)'` → on_fail: Run: python3 -m pip install zvt then re-run: python3 -m zvt.init_dirs ... PC-02 ... Run recorder first: python3 -m zvt.recorders.em.em_stock_kdata_recorder
Only run setup or recorder commands after explicit user approval, and verify that ZVT is actually needed for the requested task.
Users may need to install packages or configure an environment that was not declared in the install metadata.
The skill mentions runtime/setup requirements, but the registry says there is no install spec and no code files, so users lack a clear, reviewable installation contract.
compatibility: Designed for Doramagic-host ecosystem ... Requires Python 3.12+ with uv package manager.
Ask the publisher to declare any required packages and setup steps in the install metadata, and independently verify package sources before installing.
Using paid or broker providers could involve account access or permissions beyond simple local pricing calculations.
The skill may lead users toward paid account or broker-backed providers, while the registry declares no credentials; the artifacts do not show credential theft, but users should notice the possible account boundary.
Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
Do not provide broker or paid-provider credentials unless the task explicitly requires them and you understand what the agent will access or change.