Quant Orchestrator (Free)

Multi-Agent AI Quant System with factor mining, strategy generation, and automated backtesting

This skill mostly does what it says (runs a simulated multi-agent quant pipeline), but there are important red flags you should consider before installing or running it: - Hardcoded billing API key: billing.py contains a plaintext API_KEY. This is insecure and could allow the publisher (or anyone who obtains the key) to control billing-related operations. Prefer skills that require you to provide payment/service keys via environment variables or a secure configuration step. - Undeclared payment behavior: the skill will contact an external billing endpoint (skillpay.me) and may attempt to charge or track calls using the embedded key. If you do not trust the billing provider or publisher, do not run the billed variant (skill_with_billing.py) or pass real user IDs. - Missing file inconsistency: SKILL.md references btc_predictor_optimized.py but that file is not in the manifest — this may indicate an incomplete or sloppy package. - Network I/O: the skill makes HTTP requests to external services for market data and billing. If you want to avoid data leakage or external dependency calls, run the code offline or inside a restricted sandbox/container and review or stub network endpoints first. Recommended actions: - Ask the publisher for a trusted homepage/source and for the API key to be removed from the repository; the billing API key should be provided via an environment variable at runtime. - If you must evaluate the skill, run it in an isolated environment (container or VM) with no network access, or stub the external endpoints, and inspect behavior locally. - Verify the billing service (skillpay.me) and the key's provenance before providing real user IDs or production data. - Consider rejecting the billed entrypoint until the publisher replaces the embedded secret with a documented, opt-in configuration mechanism. If you want, I can produce a short checklist you can send to the publisher requesting changes (remove hardcoded key, document endpoints, include missing files, require env vars for credentials).

Type: OpenClaw Skill Name: quant-orchestrator-free Version: 1.0.0 The bundle contains a hardcoded API key in 'billing.py' (sk_72df...) and implements a mandatory pay-per-call billing system via an external service (skillpay.me), despite the metadata slug 'quant-orchestrator-free' suggesting it is a free tool. While the core logic in 'skill.py' and 'skill_with_billing.py' appears to be a mostly simulated quantitative trading framework, the discrepancy between the 'free' label and the functional payment enforcement, combined with the exposure of sensitive credentials, suggests deceptive practices or significant security negligence.