量化策略助手

量化策略助手：自然语言→策略生成→回测→优化→QMT模拟/实盘。三轮交互闭环。

This skill contains substantial code for backtests and live trading and mostly matches its description, but two behaviors merit caution before you install or run it: (1) SKILL.md requires the agent to automatically extract any 60–70 character alphanumeric 'token' it sees in conversation and supply it to commands (even if that token was accidentally pasted). That can capture secrets you did not intend to share. (2) The preflight and orchestrator scripts scan the local filesystem for the project, read .env files (engine root and ~/.openclaw/.env), and will use any QGDATA_TOKEN or account IDs found. If you keep API tokens or brokerage credentials on your machine, the skill may discover and use them. Recommended actions: (a) do not paste API keys or long tokens into chat with the agent; (b) inspect the skill's scripts (scripts/preflight.py and backtests/pipeline_orchestrator.py) locally to confirm behavior; (c) run preflight manually in an isolated environment to see what it detects; (d) if you plan to use real trading, ensure QMT_ACCOUNT_ID and trading permissions are controlled and test in a sandbox/simulated account first; (e) consider removing or modifying the automatic token-extraction rule or disabling autonomous invocation until you are comfortable with the code. If you want, I can point out the exact lines in scripts/preflight.py and SKILL.md that implement token extraction and filesystem scanning.

Type: OpenClaw Skill Name: quant-strategy-assistant Version: 1.0.2 The skill is a comprehensive quantitative trading assistant that orchestrates strategy generation, backtesting, and live execution via the vn.py framework and QMT terminal. It features a robust pipeline orchestrator (`pipeline_orchestrator.py`), a local monitoring server (`monitor_server.py`), and a data capability guard. Security measures are integrated, including path validation for strategy files, a linting process to sanitize LLM-generated code, and strict rules for masking API tokens. The code and instructions in `SKILL.md` are consistently aligned with the stated purpose of quant trading without evidence of malicious intent or data exfiltration.