Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Theta Trading System
v1.2.0🎯 Theta量化交易系统v1.2.0 - 100%准确率Ridge模型，每小时自动进化，多数据源兜底，准星模型集成，实时数据验证。基于真实A股涨停股数据的智能选股系统。
⭐ 0· 96·0 current·0 all-time
bywill@wihy
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims a '100%准确率 Ridge 模型' and '每小时自动进化' using multiple data sources, but the included code contradicts these claims: train_with_real_data_v2.py trains RandomForestRegressor (not Ridge) and SelectKBest is used; models/results.json and README report conflicting metrics (e.g. cv_r2 negative, n_samples mismatch). The SKILL.md and README reference scripts/modules (theta_daily_recommendation.py, theta_analyzer.py, theta_system / theta_trading packages) that are not present in the file manifest. Data-source claims list multiple APIs (Tencent, Sina, Miaoxiang, Eastmoney) while the code primarily uses AkShare. These inconsistencies suggest the packaging or documentation is incomplete or misleading.
Instruction Scope
Runtime instructions tell the agent/user to pip install akshare/pandas/numpy/scikit-learn and run update/train/recommendation scripts. The present scripts will read and write an absolute path under /root/.openclaw/workspace/data and create logs under /root/.openclaw/workspace/logs — requiring filesystem write access. Several instructions refer to missing scripts (theta_daily_recommendation.py) and imports (theta_system, ThetaSelector) that will cause runtime errors. The scripts do perform network calls indirectly via AkShare (fetching market data) but there is no unexpected exfiltration code; still, the agent will contact external data providers when running.
Install Mechanism
No install spec is provided (instruction-only deployment). This lowers installation risk because nothing is downloaded/installed by the skill package itself beyond what the user explicitly pip-installs. The only installation instruction is to pip-install common Python packages (akshare, pandas, numpy, scikit-learn).
Credentials
The skill declares no required environment variables or credentials, which is proportionate. However, the code writes to absolute paths under /root/.openclaw/workspace (DB_PATH, LOG_PATH, MODEL_DIR), which assumes permission to write into that workspace; running as root or allowing writes to that location may have side effects. Network access is required via AkShare (expected for data fetching) but no credentials are requested.
Persistence & Privilege
always:false and standard model invocation are used. The skill does create files (database, models, logs) inside the workspace but does not request permanent platform-wide privileges or modify other skills' configurations. There is no 'always: true' or other elevated persistent privilege requested.
What to consider before installing
Things to consider before installing or running this skill:
- Credibility and claims: The README/SKILL.md advertise a '100% 准确率' Ridge model and hourly evolution, but the training script actually uses RandomForest and the packaged metrics/files contain contradictory values and sample counts. Treat marketing claims as unverified until you can reproduce results.
- Missing files / runtime errors: The documentation references recommendation and analyzer scripts and Python modules that are not present in the package (theta_daily_recommendation.py, theta_analyzer.py, theta_system/theta_trading). Expect runtime failures; ask the author for the missing files or a complete release.
- Run in a sandbox: If you want to test it, run the package inside an isolated environment or container (not as root) so filesystem writes under /root/.openclaw/workspace cannot affect your host. Inspect and run scripts manually rather than allowing any agent to execute them autonomously.
- Inspect network activity: The code uses AkShare which fetches market data from external providers. If you care about data privacy or want to audit traffic, monitor outbound connections while running the scripts.
- Validate models and data: The dataset is small (documented as ~16 trading days / 843 entries in places but other files show different sample counts). Validate feature engineering, cross-validation, and out-of-sample performance yourself before using any suggestions for real trading.
- Do not use for real money without verification: Given the mismatched claims and potential overfitting, do not deploy this system for live trading until you (1) reproduce the training/evaluation, (2) verify datasets and metrics, and (3) implement missing components and safety checks.
- Ask for provenance: Request the full source, author verification, and a reproducible training log. If the skill author cannot provide missing files or a reasonable explanation for the inconsistencies, avoid using it.Like a lobster shell, security has layers — review code before you run it.
a-sharevk97e2gbcyepmf45k2x8tq645cs83besrlatestvk973sqyhkn86xh1my0ntsjpgv183ht3qlimit-upvk97e2gbcyepmf45k2x8tq645cs83besrmachine-learningvk97e2gbcyepmf45k2x8tq645cs83besrquantitative-tradingvk97e2gbcyepmf45k2x8tq645cs83besrstock-selectionvk97e2gbcyepmf45k2x8tq645cs83besr
License
MIT-0
Free to use, modify, and redistribute. No attribution required.