Technical Indicators

计算A股常用技术指标和量价形态，支持多指标共振分析并提供信号强度评分和策略回测功能。

What to check before installing: - Review integration.py, ml_predictor.py and any modules that might call network endpoints for hardcoded URLs or credential use. The SKILL.md names AkShare and 东方财富 as data sources (both network-based); confirm you are comfortable with network access and that no secret will be uploaded unexpectedly. - The docs list notification push (Feishu, email) and reference a 'webchat' request channel — search the code for Feishu/SMTP/webhook usage and verify where credentials should be provided and how they’re stored (no env vars are declared now). - The SKILL.md only asks to pip install akshare pandas numpy, but the codebase and enhancement docs reference ML libraries (LSTM, LightGBM), scipy, or other tooling. Expect to install additional packages to use ML/optimizer features; run tests in an isolated environment first. - The acceptance/checklist items are partially inconsistent with included backtest results (backtest_result.json shows negative/poor metrics). Do not assume the skill meets the '回测胜率>55%' claim without validating on your own data. - Run the package in a sandboxed environment (or container/VM) first, inspect network traffic during operation, and confirm no unexpected outbound connections or attempts to read unrelated system files. If you plan to enable notification pushes, provide credentials only to trusted endpoints and follow least-privilege principles. If you want, I can: (1) scan the remaining omitted files for network calls, subprocess usage, or os.environ access; (2) list imports from all files to identify additional undeclared dependencies; or (3) point to specific lines to inspect for credential usage.

Type: OpenClaw Skill Name: technical-indicators Version: 1.1.0 The skill bundle provides a comprehensive suite of tools for financial technical analysis, market sentiment scoring, and price prediction using LSTM models. However, it is classified as suspicious due to a critical security vulnerability in `ml_predictor.py`, which uses `pickle.load` to deserialize scaler data. This is a well-known insecure deserialization flaw that can lead to Remote Code Execution (RCE) if a malicious file is loaded. Additionally, `alert_system.py` implements a webhook-based notification system (`FeishuPusher`) which, while functional for its stated purpose, could be leveraged for data exfiltration if the agent is manipulated via prompt injection.