Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Tqsdk Futures Api

v0.3.3

TqSdk 是中国期货市场的实时行情获取与策略回测框架,支持期权定价模型构建和波动率因子分析,可用于网格交易、目标仓位管理等量化场景。。

0· 87·0 current·0 all-time
byTang Weigang@tangweigang-jpg

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for tangweigang-jpg/tqsdk-futures-api.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Tqsdk Futures Api" (tangweigang-jpg/tqsdk-futures-api) from ClawHub.
Skill page: https://clawhub.ai/tangweigang-jpg/tqsdk-futures-api
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install tangweigang-jpg/tqsdk-futures-api

ClawHub CLI

Package manager switcher

npx clawhub@latest install tqsdk-futures-api
Security Scan
Capability signals
CryptoRequires walletCan make purchasesRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md and reference files describe a Python-based backtesting/market-data pipeline (TqSdk / ZVT / ZVT-related tooling) and explicitly state a requirement for Python 3.12+ and the 'uv' package manager; however the published skill metadata declares no required binaries, no install steps, and no required environment variables. The name implies a TqSdk futures API but the content mixes TqSdk, ZVT, qlib and other frameworks—this mixing is plausible for a finance blueprint but the manifest omits dependencies that the runtime instructions appear to need.
!
Instruction Scope
SKILL.md / seed.yaml instruct the agent to re-read seed.yaml, run preconditions that execute python commands, check/install zvt, and touch ZVT_HOME (~/.zvt). Those runtime instructions can run shell/python commands and create files. While this is expected for a backtest helper, the skill does not declare those operations in its manifest and gives the agent broad discretion (reload source files, run precondition commands, run installers referenced by seed.yaml).
Install Mechanism
There is no install spec in the registry (instruction-only), which is lower-risk by itself. However seed.yaml/execution_protocol references install recipes and 'install_trigger' semantics, yet no install recipes are supplied in the manifest—this is an inconsistency (either the install steps are missing from the published package or the seed.yaml was included as a derivative without the actual install mechanism).
!
Credentials
The skill references external data providers and brokers (eastmoney, joinquant, akshare, qmt) that commonly require API keys/accounts, and preconditions reference ZVT_HOME and running python pip installs. Yet requires.env is empty and no primary credential is declared. The skill may therefore prompt for or attempt to use credentials at runtime without declaring them up-front.
Persistence & Privilege
always:false and model invocation allowed (normal). The SKILL.md instructs writing/creating files under a tool-specific data directory (ZVT_HOME) and running installers if preconditions fail; this is normal for tooling but the absence of declared install steps/permissions makes the intended persistence unclear. No 'always:true' privilege detected.
What to consider before installing
This is an instruction-only finance/backtest skill that appears to expect a Python environment (SKILL.md claims Python 3.12+ and uv) and existing toolkits (zvt, tqsdk, joinquant/other recorders) even though the published manifest lists no required binaries, env vars, or install steps. Before installing or invoking it: (1) Ask the author to clarify and publish exact runtime requirements (Python version, pip/uv commands, required packages and their install sources). (2) Don't provide broker/API credentials (joinquant, qmt, broker tokens) until the skill explicitly requests them and you verify why they are needed. (3) Run the skill in a sandbox/container or ephemeral environment first — it may run pip installs and create/modify ~/.zvt or other data dirs. (4) Review seed.yaml and the referenced precondition/install steps yourself; request a proper install spec or whitelist of commands. (5) If you permit autonomous invocation, limit it until the dependency/installation gaps are resolved. If you want, I can produce a short checklist of specific questions to send to the skill author or a minimal safe sandbox run plan.

Like a lobster shell, security has layers — review code before you run it.

datavk974ef8f14jkp41cgf216snxtx85c6ggderivativesvk974ef8f14jkp41cgf216snxtx85c6ggdoramagic-crystalvk974ef8f14jkp41cgf216snxtx85c6ggfinancevk974ef8f14jkp41cgf216snxtx85c6ggfuturesvk974ef8f14jkp41cgf216snxtx85c6gglatestvk974ef8f14jkp41cgf216snxtx85c6ggquantvk974ef8f14jkp41cgf216snxtx85c6gg
87downloads
0stars
3versions
Updated 3d ago
v0.3.3
MIT-0

TqSdk 期货接口 (tqsdk-futures-api)

TqSdk 是中国期货市场的实时行情获取与策略回测框架,支持期权定价模型构建和波动率因子分析,可用于网格交易、目标仓位管理等量化场景。

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (2 total)

Basic Quote Retrieval Demo (UC-101)

Demonstrates basic TqSdk library usage by connecting to a simulated trading account and retrieving real-time quote data for a futures contract Triggers: demo, quote, price

Time-Dependent Volatility BS Pricing Model (UC-102)

Analyzes time-dependent volatility patterns in CSI 300 index to extend the standard Black-Scholes option pricing model for improved accuracy Triggers: volatility, BS pricing, option

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

  • Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
  • Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
  • Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
  • Time range: start_timestamp and end_timestamp for backtest period
  • Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

IDRuleOn Violation
SL-01Execute sell orders before buy orders in every trading cyclehalt
SL-02Trading signals MUST use next-bar execution (no look-ahead)halt
SL-03Entity IDs MUST follow format entity_type_exchange_codehalt
SL-04DataFrame index MUST be MultiIndex (entity_id, timestamp)halt
SL-05TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amounthalt
SL-06filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTIONhalt
SL-07Transformer MUST run BEFORE Accumulator in factor pipelinehalt
SL-08MACD parameters locked: fast=12, slow=26, signal=9halt

Full lock definitions: references/LOCKS.md

Top Anti-Patterns (25 total)

  • AP-ZVT-183: 除权因子为 inf/NaN 时直接参与乘法导致复权静默失败
  • AP-ZVT-179: 第三方数据接口超限后异常被吞噬,数据静默缺失
  • AP-ZVT-183B: HFQ(后复权)与 QFQ(前复权)K 线表使用错误导致因子计算漂移

All 25 anti-patterns: references/ANTI_PATTERNS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-069. Evidence verify ratio = 44.6% and audit fail total = 9. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

FileContentsWhen to Load
references/seed.yamlV6+ 全量权威 (source-of-truth)有行为/决策争议时必读
references/ANTI_PATTERNS.md25 条跨项目反模式开始实现前
references/WISDOM.md跨项目精华借鉴架构决策时
references/CONSTRAINTS.mddomain + fatal 约束规则冲突时
references/USE_CASES.md全量 KUC-* 业务场景需要完整示例时
references/LOCKS.mdSL-* + preconditions + hints生成回测/交易代码前
references/COMPONENTS.mdAST 组件地图(按 module 拆分)查 API 时

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-069 blueprint at 2026-04-22T13:00:23.700958+00:00. See human_summary.md for non-technical overview.

Comments

Loading comments...