Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Precise T Trading

v1.0.4

Professional T+0 intraday trading system for Chinese A-shares. Uses Bayesian inference, Kelly criterion, and VaR risk management to optimize day-trading deci...

0· 45·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description, network access (qt.gtimg.cn), and included scripts all align with a T+0 intraday analysis/monitoring tool. Dependencies (numpy, scipy, requests, colorama) are appropriate for numeric analysis and network calls.
!
Instruction Scope
SKILL.md instructs editing scripts/config.py and running monitor/analysis scripts, but no scripts/config.py file is present in the package. The monitor script saves logs to a hard-coded absolute Windows path (I:\OpenClawWorkspace\stocks\监控日志) rather than a relative or user-configurable location, which is unexpected and could fail or create files in surprising places. Documentation references publish scripts (publish.ps1/publish.bat) that are not included.
Install Mechanism
This is instruction-only with a standard pip dependency list and requirements.txt; there is no external archive download or obscure installer. Install instructions are proportional to the described functionality.
Credentials
The skill requests no credentials or environment variables. SKILL.md lists optional env vars for default stock and total shares (reasonable). However, the code writes cache and logs to disk (cache/ and an absolute I: path), which means it will create files locally without explicit configuration unless the user edits the scripts.
!
Persistence & Privilege
always:false and no autonomous special privileges — good. But the monitor script is designed to run continuously and will create log files (and tries to write to the author's I: drive). The skill will persist data locally (cache/, monitor_logs) and may run long-lived monitoring loops if the user enables them.
What to consider before installing
This skill appears to implement the advertised trading calculations and uses Tencent's quote API, but there are some concerning inconsistencies you should address before running it: 1) Missing/incorrect files: SKILL.md tells you to edit scripts/config.py but that file is not present in the package. The code expects certain config values; locate where to set them (some defaults exist in t_trading_analysis.py) or contact the author. 2) Hard-coded author paths: scripts/stock_monitor.py writes logs to a hard-coded Windows path (I:\OpenClawWorkspace\stocks\监控日志). Edit this to a safe, relative, or configurable directory before running to avoid surprising writes or failures. 3) Run in a contained environment: use a Python virtual environment, inspect the scripts, and run them locally (paper-trade / no real orders). The package does not request credentials, but it will access the network (qt.gtimg.cn) to fetch quotes. 4) Test and review: run t_trading_analysis.py with test inputs and verify outputs. Because some code uses simulated historical data and placeholder values, validate the math and data sources before trusting recommendations. 5) If you plan to use monitoring: change the log/cache paths to a directory you control, and consider running monitor_once() instead of the continuous loop until you confirm behavior. What would change this assessment: inclusion of the expected config.py, removal of author-local absolute paths (or making paths user-configurable), and consistent documentation (or publish scripts) would raise confidence to benign. Conversely, discovery of hidden network endpoints, credential collection, or obfuscated code would raise severity.

Like a lobster shell, security has layers — review code before you run it.

latestvk97f8bs9620wqn7wss6ky4ks0n847zef

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments