Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Tensortrade Rl Env

v0.3.3

提供多市场回测与强化学习交易环境构建能力,支持多交易所钱包组合管理、Plotly交互式交易可视化及RL智能体训练评估。

0· 101·0 current·0 all-time
byTang Weigang@tangweigang-jpg

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for tangweigang-jpg/tensortrade-rl-env.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Tensortrade Rl Env" (tangweigang-jpg/tensortrade-rl-env) from ClawHub.
Skill page: https://clawhub.ai/tangweigang-jpg/tensortrade-rl-env
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install tensortrade-rl-env

ClawHub CLI

Package manager switcher

npx clawhub@latest install tensortrade-rl-env
Security Scan
Capability signals
CryptoRequires walletRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
Name/description claim a TensorTrade-style RL trading environment (multi-market backtesting, wallets, Plotly visualization, RL training) and the provided files are documentation-heavy and domain-appropriate. However SKILL.md states a runtime requirement (Python 3.12+ with the 'uv' package manager) and references ZVT (zvt import/get_kdata) and multi-exchange examples, yet the registry metadata declares no required binaries, no required env vars, and no config paths. That mismatch (declared none vs. instructions that expect Python, 'uv', and ZVT) is incoherent and should be resolved before trust.
!
Instruction Scope
Runtime instructions (preconditions) tell the agent to run Python import checks, call get_kdata, possibly run pip installs (python3 -m pip install zvt), check and create ZVT_HOME and write test files under ~/.zvt. Those are file-system writes and package installs outside a pure 'documentation' scope. They also reference environment variable ZVT_HOME and advise creating directories — but requires.env did not declare ZVT_HOME. The SKILL.md otherwise stays in-domain (no external endpoints or exfiltration instructions), but the preconditions grant the agent discretion to install packages and write into the user's home directory which is not declared.
Install Mechanism
This is an instruction-only skill with no install spec or code files — low intrinsic install risk. However SKILL.md tells the agent to verify Python imports and run pip installs when preconditions fail (e.g., 'python3 -m pip install zvt'), which means the agent may attempt to install third-party packages at runtime. Because there is no declared installation recipe or pinned sources, the agent's behavior depends on runtime execution policy; that increases operational uncertainty.
!
Credentials
Registry metadata lists zero required environment variables, yet SKILL.md references ZVT_HOME in preconditions and uses multi-exchange wallet examples (Bitfinex, Bitstamp) which commonly require exchange API keys — but no credentials or primaryEnv are declared. The skill also instructs writing into ~/.zvt (permission checks). Missing declarations for these environment/config accesses are disproportionate and should be clarified before use.
Persistence & Privilege
Permissions flags are default (always: false, agent may invoke autonomously). The skill does not request forced always-on presence nor claim to modify other skills or system-wide settings. Its directives to re-read seed.yaml and run preconditions are self-contained and do not create persistent platform-level privileges.
What to consider before installing
This skill looks like domain-appropriate documentation for building RL trading/backtest pipelines, but there are a few red flags you should address before running it: - Source trust: the skill's source/homepage is unknown and the license is proprietary — only proceed if you trust the publisher. - Declared vs. actual requirements: SKILL.md requires Python 3.12+ and the 'uv' package manager and references the ZVT runtime (and the ZVT_HOME env var), but the registry metadata lists no required binaries, env vars, or config paths. Treat that as a mismatch—set up a clean environment yourself (see below) rather than letting an agent auto-install. - File writes & installs: the skill's preconditions will attempt to pip-install zvt and create/write ~/.zvt; do not run these steps on a sensitive machine. Use a dedicated virtualenv/container (Python 3.12) or sandbox. - Credentials: examples mention multi-exchange wallets (Bitfinex/Bitstamp); do NOT supply real exchange API keys unless you understand exactly how the skill uses them and you trust the code — prefer simulated wallets first. The skill does not declare any required KEY/TOKEN vars, so any prompt for secrets should be treated suspiciously. - Review important files: inspect references/LOCKS.md, references/seed.yaml and references/ANTI_PATTERNS.md yourself to understand fatal semantic checks (e.g., next-bar execution, T+1 rules) before running automated backtests. Recommended safe steps: run in an isolated VM/container; create a Python 3.12 virtualenv; set ZVT_HOME to a disposable directory you control; inspect the seed.yaml and SKILL.md contents locally; run only read-only prechecks first (import checks) and refuse automatic pip installs unless you audit the packages and trust PyPI sources. If you must run production-style backtests, prepare simulated data and avoid providing any live-exchange credentials until the code provenance is verified.

Like a lobster shell, security has layers — review code before you run it.

doramagic-crystalvk97cdwbyzv4gmtz8hsyc94fqs185c1f6financevk97cdwbyzv4gmtz8hsyc94fqs185c1f6latestvk97cdwbyzv4gmtz8hsyc94fqs185c1f6portfoliovk97cdwbyzv4gmtz8hsyc94fqs185c1f6quantvk97cdwbyzv4gmtz8hsyc94fqs185c1f6rlvk97cdwbyzv4gmtz8hsyc94fqs185c1f6
101downloads
0stars
3versions
Updated 5d ago
v0.3.3
MIT-0

强化学习交易环境 (tensortrade-rl-env)

提供多市场回测与强化学习交易环境构建能力,支持多交易所钱包组合管理、Plotly交互式交易可视化及RL智能体训练评估。

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (19 total)

Sphinx Documentation Configuration (UC-101)

Infrastructure configuration for building TensorTrade documentation using Sphinx Triggers: documentation, sphinx, config

Portfolio Ledger Setup with Multi-Exchange Wallets (UC-102)

Demonstrates how to set up a portfolio with wallets across multiple exchanges (Bitfinex, Bitstamp) and different trading pairs for simulated trading Triggers: portfolio, wallet, ledger

Trading Chart Visualization with Plotly (UC-103)

Visualizes historical price data with technical analysis indicators on interactive Plotly charts for trading analysis and reporting Triggers: chart, plotly, visualization

For all 19 use cases, see references/USE_CASES.md.

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

  • Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
  • Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
  • Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
  • Time range: start_timestamp and end_timestamp for backtest period
  • Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

IDRuleOn Violation
SL-01Execute sell orders before buy orders in every trading cyclehalt
SL-02Trading signals MUST use next-bar execution (no look-ahead)halt
SL-03Entity IDs MUST follow format entity_type_exchange_codehalt
SL-04DataFrame index MUST be MultiIndex (entity_id, timestamp)halt
SL-05TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amounthalt
SL-06filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTIONhalt
SL-07Transformer MUST run BEFORE Accumulator in factor pipelinehalt
SL-08MACD parameters locked: fast=12, slow=26, signal=9halt

Full lock definitions: references/LOCKS.md

Top Anti-Patterns (25 total)

  • AP-ZVT-183: 除权因子为 inf/NaN 时直接参与乘法导致复权静默失败
  • AP-ZVT-179: 第三方数据接口超限后异常被吞噬,数据静默缺失
  • AP-ZVT-183B: HFQ(后复权)与 QFQ(前复权)K 线表使用错误导致因子计算漂移

All 25 anti-patterns: references/ANTI_PATTERNS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-130. Evidence verify ratio = 24.5% and audit fail total = 31. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

FileContentsWhen to Load
references/seed.yamlV6+ 全量权威 (source-of-truth)有行为/决策争议时必读
references/ANTI_PATTERNS.md25 条跨项目反模式开始实现前
references/WISDOM.md跨项目精华借鉴架构决策时
references/CONSTRAINTS.mddomain + fatal 约束规则冲突时
references/USE_CASES.md全量 KUC-* 业务场景需要完整示例时
references/LOCKS.mdSL-* + preconditions + hints生成回测/交易代码前
references/COMPONENTS.mdAST 组件地图(按 module 拆分)查 API 时

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-130 blueprint at 2026-04-22T13:01:05.354545+00:00. See human_summary.md for non-technical overview.

Comments

Loading comments...