X2strategy

ALAGENT X2Strategy: any research input (PDF paper, Markdown draft, DOCX report, text notes, or keyword search) → structured strategy specification → executab...

What to check before installing or running this skill: - Source verification: confirm the repository origin and maintainers (the skill metadata shows 'source: unknown' and README references multiple GitHub org/user names). Only install from a trusted, verifiable repo. - Secrets handling: the skill will ask for an LLM API key and write it into a local .env (gitignored). Prefer using a limited-scope or ephemeral API key, and store it in a secure secret store rather than a plaintext file where possible. - Sandbox execution: the skill generates Python strategy code and runs backtests as subprocesses. Run it in an isolated environment (container / VM / dedicated venv) with no access to production data or credentials. - Inspect code that executes subprocesses: review scripts/ (analyze.py, validate_strategy.py, backtest execution paths) to ensure no unexpected network or shell commands are executed beyond intended backtests and downloads (data pulls like yfinance/akshare/benchmarks are expected for this domain). - Dependency footprint: the agent may install heavy packages (FAISS, sentence-transformers). Be prepared for large downloads and resource usage; only enable the 'agent' extras if you need long-paper FAISS retrieval. - Metadata mismatch: registry lists no required env vars but SKILL.md requires LLM keys — treat the registry fields as incomplete. Ask the maintainer (or verify repo) for an authoritative requirements list and changelog. If you want higher confidence: obtain the source repo URL and a commit/tag to verify, have the skill run in an isolated environment first, and/or request the maintainer to update registry metadata to list required env vars and install steps. If you lack the ability to sandbox, avoid supplying high-privilege or long-lived keys.

Type: OpenClaw Skill Name: x2strategy Version: 0.1.1 The x2strategy skill is a legitimate and well-structured tool for quantitative finance research, designed to automate the conversion of academic papers into executable Backtrader strategies. It features a robust 5-layer LLM extraction pipeline and includes a dedicated validation module (spec2code/validator.py) that performs AST syntax and structural checks on generated code before execution. The skill implements security best practices by incorporating mandatory human-in-the-loop (HITL) gates in the SKILL.md instructions, ensuring users review strategy specifications before any code is generated or run. While the skill handles sensitive API keys and executes generated Python code, these behaviors are essential to its stated purpose and are mitigated by the aforementioned validation and user-confirmation steps. A hardcoded environment path in the test runner (scripts/run_full_tests.sh) is a non-malicious developer artifact.