Sequoia-X

A股量化选股系统 Sequoia-X V2 的安装、配置与使用。当用户要求安装 Sequoia-X、使用 Sequoia-X 选股、运行量化策略、配置飞书推送时激活。

Before installing: 1) Inspect the upstream repository (https://github.com/sngyai/Sequoia-X) — especially main.py and any network/webhook logic — because the install will clone and run that code. 2) Confirm you have git, Python and pip and consider running install inside a dedicated venv or sandbox to avoid contaminating your global environment. 3) The skill asks you to put a FEISHU webhook URL into ~/sequoia-x/.env; that is a secret-like endpoint — only provide a webhook you control and expect that the code will POST selected stock lists to it. 4) If you cannot review the cloned repo, treat this as higher risk: either run in an isolated VM/container or avoid installing. 5) The skill metadata should have declared git/python/pip and the webhook requirement — the absence is an incoherence; ask the publisher to correct the manifest or provide code bundled with the skill for review.

Type: OpenClaw Skill Name: sequoia-x Version: 1.0.0 The skill automates the installation and execution of an external software package by cloning a GitHub repository (https://github.com/sngyai/Sequoia-X.git) and running its Python entry point. While this behavior is aligned with the stated purpose of providing a quantitative trading tool, the practice of downloading and executing remote code without integrity verification (e.g., commit pinning or checksums) constitutes a high-risk capability. Additionally, the SKILL.md file instructs the AI agent to perform shell-based discovery and execution of scripts (install.sh and run.sh), which increases the potential attack surface for remote code execution if the external repository is compromised.