量化策略研发实验室

PassAudited by VirusTotal on May 5, 2026.

Overview

Type: OpenClaw Skill Name: quant-research-lab Version: 1.0.1 The quant-research-lab skill bundle is a highly sophisticated multi-agent framework designed for quantitative strategy research and development. It orchestrates 15 specialized agent roles modeled after top-tier financial institutions (e.g., Goldman Sachs, Citadel, Renaissance Technologies) to perform tasks such as strategy architecture, backtesting, risk management, and compliance. The orchestration logic in SKILL.md and the detailed prompt templates in the roles/ directory are strictly aligned with the stated purpose. The bundle uses a local state file (state/research-context.md) for workflow persistence and includes robust 'Quality Gate' checks. No indicators of malicious behavior, such as data exfiltration, unauthorized network calls, or prompt injection attacks against the host agent, were detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Past strategy outputs and financial context can influence later runs, and sensitive user-entered details may remain in the project directory.

Why it was flagged

The skill creates and reuses a persistent local research-context file containing user-provided market, capital, and focus information.

Skill content
检查 `state/research-context.md` 是否存在... 新建... 将答案填入 state 文件的 `## 项目上下文` 区
Recommendation

Review or reset the state file between projects, and do not enter exchange credentials, account numbers, or other secrets into the workflow.

What this means

User-provided financial context and project architecture notes may be included in subagent prompts during pipeline execution.

Why it was flagged

The skill passes collected context and role prompts into subagents as part of its multi-agent workflow.

Skill content
Dispatch subagent:使用 Agent tool,`subagent_type: "general-purpose"`... 注入替换后的完整 prompt
Recommendation

Use the pipeline only for information you are comfortable sharing with the agent runtime, and avoid including private credentials or confidential account details.

What this means

If installing from the external repository rather than the reviewed package, the installed content could differ from the provided artifacts.

Why it was flagged

The README documents installation from an external GitHub repository via npx; this is user-directed and not an automatic install step in the skill package.

Skill content
npx skills add https://github.com/yili1992/quant-research-lab --skill quant-research-lab
Recommendation

Install from a trusted source, review the repository contents, and pin a known commit or version when possible.

What this means

Users could overvalue generated trading strategies because of the institutional-style framing, even though the artifact says it is educational only.

Why it was flagged

The skill uses strong institutional branding for financial strategy generation while also clearly disclaiming that it is not trading advice.

Skill content
institutional-grade quantitative strategy research workflow... modeled after the expertise of a top quant firm... Disclaimer: This framework is designed for research and educational purposes only.
Recommendation

Treat outputs as research drafts, validate independently with real data and professional review, and do not trade solely based on generated results.