TradingView Screener

Screen markets across 6 asset classes using TradingView data. API pre-filters + pandas computed signals. YAML-driven strategies.

This skill is internally consistent with its description and is likely safe to inspect/try if you trust the included tvscreener package and the author. Before installing or running it: - Review any signal YAMLs you did not create yourself. Computed signals use pandas df.eval and user-supplied expressions are validated but validation is not bulletproof — treat untrusted YAMLs as potentially unsafe. - Install and run inside an isolated environment (VM or container) since install.sh will pip-install packages from PyPI into a .venv in the skill directory. - Verify the trustworthiness of the external dependency 'tvscreener' (it will be downloaded from PyPI) before use, especially if you plan to run it on sensitive systems. - If you want stricter safety, run the scripts in read-only mode against sample data first (or run tests) and avoid loading signal files from unknown sources. If you want, I can: (a) inspect any specific YAML signal file for risky expressions, (b) summarize the exact functions that call df.eval and how expressions are validated, or (c) outline a safe sandboxed workflow to run the skill.

Type: OpenClaw Skill Name: tradingview-screener Version: 1.1.0 The OpenClaw AgentSkills bundle is classified as benign. The `install.sh` script performs standard virtual environment setup and dependency installation from a local `requirements.txt` without suspicious external calls. The Python scripts (`screen.py`, `signal_engine.py`, `signal_types.py`) primarily interact with the `tvscreener` library and `pandas` for data processing. Crucially, the `signal_types.py` module includes robust `validate_expression` logic with a strict character whitelist and a keyword blacklist (e.g., `import`, `exec`, `eval`, `open`, `os`, `sys`, `lambda`) to prevent arbitrary code execution when using `df.eval()`. The `SKILL.md` and other documentation files clearly describe the skill's functionality and do not contain any prompt injection attempts or instructions for malicious actions.