Security audit
Security checks for vulnerabilities and agentic risk
This skill is a Chinese-language educational quant research package with local backtest examples and no evidence of hidden execution, credential use, persistence, or trading authority.
Install only if you want a Chinese-language quant research and backtesting aid. Treat generated strategies and backtests as educational, validate with independent data and paper trading, include costs/slippage/leverage risks, and do not connect broker credentials or trading authority unless separately reviewed.
声明描述的是一个面向量化/期货文献解读与真实数据回测的综合助手，包含文本解读、参数说明、文献出处以及调用外部数据能力。实际代码只是一个单文件回测护栏演示：生成模拟价格、在训练集上扫描均线参数、在测试集上比较 Sharpe 衰减并给出过拟合提示。虽然它与量化回测主题相关，也可勉强算作“可运行回测模板”的一个很小子集，但其核心行为与声明的主要用途并不一致，且缺失关键承诺能力（文献解读、真实行情/MCP 调用、期货策略覆盖）。因此应判定为描述与行为存在实质性不匹配。
两者存在明显的功能与目的偏差。声明描述的是一个面向量化交易和期货文献复现的助手型技能，核心价值在于解释、模板化回测、参数说明、文献出处以及接入真实行情数据。实际代码则是一个独立的教学演示脚本，主要展示权益资产上的简单动量因子与简化组合优化，不涉及期货、不涉及英文文献转中文解读、不访问真实数据，也没有 MCP 调用。因此其主要用途与声明不一致，属于实质性描述-行为不匹配。
声明描述的是一个面向量化交易与期货策略研究的综合助手，核心能力应包括策略解读、文献复现、回测模板生成以及真实数据回测。而实际代码仅包含一个简单的数学演示函数 fill_prob(queue_pos, lam)，用于说明限价单成交概率随队列位置指数衰减，并在命令行打印若干示例值。这与声明中的主要用途存在明显偏离：既没有策略级别逻辑，也没有回测框架、数据接入、MCP 调用、pandas 模板或文献解析输出。虽然代码内容仍属于量化交易相关领域，但它的实际功能是狭窄的微观结构示意脚本，不能视为对所声明技能能力的准确实现。
声明描述的是一个面向量化交易与期货策略的分析/回测助手，核心能力应包括文献策略解读、回测模板生成、参数说明以及真实数据回测。实际代码却只是一个教学性质的统计演示脚本，使用模拟数据展示高频收益的波动聚集与 √Δt 缩放规律。这与“策略解读助手”的主要用途存在明显偏离。代码没有任何数据查询、回测、策略逻辑、期货品种处理、文献解析或模板生成功能，因此属于材料性目的不一致。
声明描述的是一个面向量化/期货策略研究的助手，核心能力应包括：解读英文文献、生成中文策略说明、提供可运行回测模板，并结合真实行情数据回测。实际代码却仅是一个简单的执行算法示例，演示如何按平坦或 U 形权重拆分大单并计算与目标成交量曲线的误差。这属于交易执行（execution）范畴，不是策略解读或回测系统。虽然 VWAP/TWAP 与量化交易领域相关，但其主要用途与声明的核心用途存在明显偏差，因此应判定为描述与行为不匹配。
声明的核心能力是‘文献策略解读 + 回测模板 + 真实行情回测’，面向量化交易与期货策略分析。实际代码则是一个独立的 Kelly 资金管理计算脚本，输入为胜率、盈亏比或收益序列，输出为 Kelly 和半 Kelly 仓位比例，并通过随机生成的收益序列进行演示。它不包含期货策略逻辑、双均线/海龟/均值回归等触发领域内容，也没有任何数据查询、回测框架、文献解析或中文解读功能。因此其主要用途与声明存在实质性偏差，应判定为不匹配。
声明的核心用途是“量化交易与期货策略解读 + 回测”，重点在策略层面的说明、文献复现和基于真实行情的数据回测；而实际代码是一个独立的期权分析脚本，仅做 Black-Scholes 定价与 Greeks 计算示例。两者在领域焦点上虽都属于金融，但主功能明显不同：一个是量化/期货策略研究助手，另一个是期权定价数学计算工具。代码也没有任何数据查询、回测框架、策略参数管理、文献解读或 pandas 处理逻辑，因此属于明显的描述与行为不一致。
声明的核心用途是“量化/期货交易策略解读与回测”，重点在策略思想转换、回测模板生成和真实行情回测。实际代码的核心用途则是金融风险度量教学演示，围绕波动率预测和尾部风险指标展开。虽然风险管理与量化金融相关，但这里的主功能与声明不一致，且缺少声明中最关键的能力：策略逻辑、回测、真实数据接入、文献解读输出。因此应判定为明显不匹配。
声明描述的是一个较完整的量化/期货策略研究助手，核心能力应包括：解读英文文献、生成策略回测模板、说明参数、给出文献出处，并调用外部数据源进行真实行情回测。实际提供的代码只是一个独立的 Python 演示脚本，用历史收益率波动的倒数来计算风险平价近似权重，且示例数据为随机生成。它没有任何外部数据访问、没有回测引擎或交易规则、没有文献解析或中文解读输出，也没有体现期货策略场景。因此其主要用途与声明存在实质性偏差，应判定为不匹配。
声明描述的是一个较完整的量化策略研究/解读助手，核心能力应包括文献策略转译、回测模板生成以及真实行情数据调用。实际代码只是一个独立的 Python 演示脚本，功能局限于依据历史收益波动率计算目标仓位权重，并用随机数据做示例输出。虽然该主题仍属于量化交易范畴，但其主要目的与声明相比明显更窄，且缺少声明中的关键能力，因此构成描述与实际行为不匹配。
The document explicitly states '中文方法论解读' and '只做中文重写', which imposes a Chinese-only language policy in the skill content. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, which is not present here.
The text states that all subsequent strategy chapters will '只做中文解读', which imposes a specific language for the skill's content. Under the policy, language restrictions are a violation unless the skill offers opt-in or clearly documents a justified locale-specific constraint.
The file explicitly prescribes a Chinese-only processing method and Chinese rewriting approach. This is a natural-language locale policy constraint, and the document does not provide any user opt-in, alternative language option, or justification for restricting output to Chinese.
The document explicitly states the processing method is a Chinese methodology interpretation and that the skill only performs Chinese rewriting. This is a natural-language locale policy constraint presented as mandatory behavior, with no indication that users may choose another language or opt in to the Chinese-only mode.
The file provides concrete trading strategy logic, parameter guidance, and runnable backtest templates, while lacking a prominent warning that the material is educational only and not investment advice. In the context of a skill that explicitly claims it will fetch real market data for backtesting, users may over-trust the outputs and deploy strategies without understanding leverage, slippage, regime dependence, or risk of loss.
Suspicious Unicode normalization or mixed-script content
The document states the processing method is a Chinese-language methodological interpretation and repeatedly frames the skill output as being rewritten in Chinese. This imposes a language choice in the skill description without any opt-in or alternative language option, which matches the policy category for language/locale constraints.
The module docstring is entirely in Chinese, and the skill does not indicate that the user can opt into another language or that the skill is intentionally restricted to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation.
The comments and printed messages in the executable example are Chinese-only, including the visible warning at runtime. This imposes a specific language on users without an opt-in or documented locale justification.
Suspicious Unicode normalization or mixed-script content
This code file contains natural-language instructions and descriptions entirely in Chinese, including the usage text, without any indication that the skill is region-specific or that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
The module docstring and all user-facing usage/output text are written only in Chinese, with no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
This code file contains user-facing natural-language content entirely in Chinese in the module docstring and later console output, but it does not offer any language choice or explain that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The program prints all user-visible results in Chinese and does not provide a configurable locale or any opt-in mechanism. This is a direct language policy issue because the skill enforces one language for interaction regardless of user preference.
The module docstring presents all usage instructions in Chinese, and the script's user-facing text assumes that locale without any opt-in or indication that the tool is intended only for Chinese-speaking users. The policy for this audit flags language/locale constraints when a skill forces a specific language without user choice or clear justification.
