Tearsheet Generator

Generate professional tearsheets with custom SVG visualizations using the QuantStats library. Creates performance reports with MAE analysis, leverage recomme...

Things to check before installing or running: - Inspect or run the code in a sandbox: review the included tearsheet_helpers.py and any referenced script (strategy_comparison_tearsheet) before executing. The helper module looks benign, but you should verify there are no hidden network calls in other files. - Ask the author to explain integrations: the SKILL.md references Nautilus Trader and Hyperliquid SDK but the skill declares no credentials or required binaries. If you expect those features, require the skill to explicitly declare the environment variables and binaries it needs. - Remove or change hard-coded absolute paths: the README points to /Users/DanBot/Desktop/dev/Backtests which is a local dev path — the skill should accept relative or configurable paths instead of hard-coded ones. - Limit agent permissions: because allowed-tools includes Bash/Read/Write/Edit/Glob, run the skill in an isolated environment (container/VM) or reduce allowed tools if possible, especially if you will provide real trading account configs. - Do not run with real account credentials or live trading enabled: any integration that can apply leverage or call exchange SDKs should only be used with test accounts after you confirm what network calls the skill makes. - Request missing details from the publisher: ask for (1) a clear list of external services the skill will call, (2) which env vars/credentials are required and why, and (3) a non-dev installation path or packaging instructions. If you only need local report generation from CSVs and will run everything offline, the skill appears functionally coherent after fixing the absolute paths; if you plan to use verification or SDK features, require the author to make credentials and network calls explicit and auditable.

Type: OpenClaw Skill Name: tearsheet-generator Version: 0.1.0 The skill is classified as suspicious due to critical vulnerabilities, primarily a hardcoded `sys.path.insert` in `commands/generate-tearsheet.md` (`/Users/DanBot/Desktop/dev/Backtests`). This path hijacking vulnerability could allow an attacker to execute arbitrary code if they control that specific local directory. Additionally, the use of user-controlled inputs like `strategy_name` in file paths (e.g., `f"{strategy_name}_comparison_metrics.json"` in `commands/verify-backtest.md`) without explicit sanitization creates a path traversal risk. While the skill's stated purpose is benign and there's no direct evidence of intentional malice (e.g., data exfiltration, backdoors), these severe vulnerabilities make it highly exploitable.