Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

虾皮市场风格轮动分析

v1.0.1

分析A股大小盘风格轮动,通过中证2000与沪深300的相对强弱差值判断风格偏向与切换信号。触发词:大小盘风格、风格轮动、大盘股小盘股、风格切换、沪深300、中证2000、微盘股投资策略。适用场景:判断市场风格偏向、识别风格切换信号、大盘小盘配置决策。不适用场景:个股分析、行业板块分析、债券分析。

0· 94·0 current·0 all-time
by三水清@ksky521
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill's stated purpose (analyzing A-share large/small-cap style rotation via a 'daxiapi' service) is plausible, but the metadata declares no required environment variables or binaries while the runtime instructions explicitly require a token and use 'npx daxiapi-cli@latest'. Legitimately, the skill needs an API token and an npm runtime (npx) — these are missing from the declared requirements.
!
Instruction Scope
SKILL.md instructs the agent to run shell commands (npx daxiapi-cli@latest market style) that will make network calls to an external service (daxiapi.com) and to read/write token configuration (~/.daxiapirc) and/or environment variables (DAXIAPI_TOKEN). This scope is consistent with the stated purpose, but the instructions give the agent the ability to execute remote code (via npx) and to access local credential storage which were not declared in metadata.
Install Mechanism
There is no install spec (instruction-only), but runtime uses 'npx ...@latest', which downloads and executes a package from the npm registry at invocation time. That is higher risk than a pure instruction-only skill because npx will fetch remote code (transient execution) and using '@latest' lacks a pinned version. No permanent files are declared, but running npx implies a dependency on Node/npm being available (not declared).
!
Credentials
The references and SKILL.md clearly require an API token (DAXIAPI_TOKEN or CLI-stored token) and mention the config file location (~/.daxiapirc). Requesting a token is proportionate to calling a third-party API, but the skill metadata did not list any required env vars or config paths. The absence of declared credentials and the CLIs' ability to persist a token to disk are discrepancies that affect risk evaluation.
Persistence & Privilege
The skill does not request 'always: true' and does not claim elevated platform privileges. It can be invoked autonomously (platform default), which is normal; this autonomy combined with the token/remote-execution concerns increases blast radius but is not by itself a metadata misconfiguration.
What to consider before installing
Before installing, verify these items: 1) The skill's metadata should declare that it needs an API token and a local npm runtime (npx). Ask the author to add required env vars (e.g., DAXIAPI_TOKEN) and required binaries (node/npm). 2) Understand that runtime uses 'npx ...@latest' — npx will download and execute remote npm code each time; prefer a pinned version (not @latest) or a vetted binary. 3) Confirm you trust the daxiapi service and the npm package owner (check homepage, source repo, and package contents). 4) Be cautious storing tokens in persistent config files (~/.daxiapirc); use temporary environment variables where possible and do not check tokens into repos. 5) If you need stronger guarantees, request the author provide a static manifest (exact npm package version or a bundled, audited implementation) and explicit declaration of all required env vars and config paths. 6) If you will allow autonomous invocation, be aware the agent could run npx and access the token — only enable that if you trust the skill and its source. If any of the above cannot be confirmed, treat the skill as higher risk and avoid installing or run it in a restricted/test environment first.

Like a lobster shell, security has layers — review code before you run it.

latestvk97aaqzbmx1gwm28hd4j1mtgmx84hffh
94downloads
0stars
2versions
Updated 1w ago
v1.0.1
MIT-0

大小盘风格轮动分析 Skill

Overview(功能概述)

使用大虾皮 API 获取中证2000(小盘代表)与沪深300(大盘代表)的相对强弱差值,结合历史分布动态计算当前差值所处的百分位,判断市场风格偏向与切换信号。

When to Use(何时使用)

  • 判断当前市场风格偏向(大盘股 vs 小盘股)
  • 分析大小盘风格轮动趋势
  • 识别风格切换信号
  • 了解市场资金流向(游资 vs 机构)

触发词:大小盘风格、风格轮动、大盘股小盘股、风格切换、沪深300、中证2000、大盘小盘

When Not to Use(何时不使用)

  • 个股层面的买卖点、基本面或财报解读
  • 行业板块层面的分析
  • 债券、基金、期货、外汇等非风格分析
  • 需要实时盘中信号或自动交易指令的请求

Process(执行流程)

Step 0: 前期准备

Token 已配置则跳过此步骤。

npx daxiapi-cli@latest config get token
# 未配置则执行:
npx daxiapi-cli@latest config set token YOUR_TOKEN

Step 1: 获取数据

npx daxiapi-cli@latest market style

返回字段说明:

  • 大小盘波动差值:中证2000近期涨跌幅 - 沪深300近期涨跌幅,正值表示小盘强,负值表示大盘强
  • 当前风格:基于差值和历史百分位的综合判断,含极端区间的均值回归概率提示
  • 历史百分位:当前差值在近两年历史分布中的相对位置

Step 2: 分析数据

拿到数据后,按以下三个维度依次分析:

维度一:当前风格定位

读取「当前风格」和「历史百分位」字段,判断当前处于哪个区间:

差值区间风格判断资金特征
> +10%小盘极端强游资高度活跃,历史上大概率将收窄
+5% ~ +10%小盘偏强游资相对主导
0% ~ +5%均衡偏小盘风格均衡,小盘略占优
-5% ~ 0%均衡偏大盘风格均衡,大盘略占优
-10% ~ -5%大盘偏强机构相对主导
< -10%大盘极端强机构高度活跃,但持续性强于小盘极端

维度二:趋势方向

观察差值序列的近期走势,判断风格是在强化还是在收敛:

  • 差值持续向正方向移动 → 小盘风格强化
  • 差值持续向负方向移动 → 大盘风格强化
  • 差值在零轴附近震荡 → 风格均衡,无明显方向

维度三:极端值的均值回归判断

仅当差值进入极端区间时触发此维度:

  • 差值 > +10%:历史数据显示,此后20日内有约92%的概率差值会收窄,平均收窄幅度约10%。小盘极端强的状态持续性较弱。
  • 差值 < -10%:历史数据显示,此后20日内有约74%的概率差值会收窄。注意:大盘极端强的状态持续性明显强于小盘极端强,不可对称处理。
  • 正常区间内:不做均值回归判断,避免过度解读。

Step 3: 生成报告

按报告模板输出,要求结论先行,数据支撑在后。

Report Template(报告模板)

报告日期:[YYYY-MM-DD]


【核心结论】

[一句话:当前风格偏向 + 是否处于极端区间 + 趋势方向。例:"当前大盘偏强,差值处于历史偏低位置,近期持续向负方向移动,尚未进入极端区间。"]


【风格定位】

当前差值 [X]%,历史百分位 P[N],[风格判断]。

[若处于极端区间,补充:根据历史统计,当前差值处于极端区间,此后20日内有[X]%的概率差值将收窄,但不排除继续分化的可能。]

【趋势分析】

[描述近期差值序列的方向性变化,引用具体数据支撑,例:"差值从[日期]的[X]%持续下行至今日的[Y]%,连续N日偏向大盘,趋势明确。"]

【均值回归判断】

[仅极端区间填写,正常区间写"当前差值处于正常区间,无极端信号。"]


【风险提示】

风格轮动受多重因素影响,历史统计规律不保证未来重现。大盘极端强的状态历史上持续性较强,需结合宏观环境综合判断。本分析仅供参考,不构成投资建议。

数据来源:大虾皮(daxiapi.com) + AI 分析生成

Quality Checks(质量检查)

必须验证

  • 报告开篇即给出核心结论,不以数据罗列开头
  • 引用了具体差值数字和百分位
  • 趋势分析有数据序列支撑,不是空泛描述
  • 极端区间必须标注均值回归概率;正常区间不得滥用"均值回归"表述
  • 大盘极端强与小盘极端强的不对称性已体现(不可对称处理)
  • 包含风险提示与免责声明

危险信号

  • 🔴 用"一定"、"必然"等绝对化词汇描述风格切换
  • 🔴 在正常区间内也做均值回归预测
  • 🔴 把大盘极端强和小盘极端强的回归概率写成一样
  • 🔴 只看当前一个差值点,不看趋势方向
  • 🔴 缺少免责声明

Common Pitfalls(常见陷阱)

  • 对称性误区:大盘极端强(<-10%)的均值回归概率(74%)远低于小盘极端强(>+10%,92%),大盘强的极端状态更容易持续,分析时必须区别对待。
  • 正常区间过度解读:差值在正常范围内的波动不代表风格切换,不要每次小幅变化都渲染成"切换信号"。
  • 忽视趋势方向:当前差值的绝对值只是截面,趋势方向(是在强化还是收敛)同样重要。
  • 数据时效:数据为收盘后更新,盘中无实时信号,不适用于日内判断。

Gotchas(避坑)

  • 401 认证失败:执行 npx daxiapi-cli@latest config get token 检查;若为空,重新配置 token。
  • 空数据返回:通常为非交易日或数据尚未更新,建议收盘后17:00以后查询。
  • 429 频率超限:等待30-60秒后重试。

References

Comments

Loading comments...