by 安全扫描
OpenClaw
安全
high confidenceThe skill's code, instructions, and dependency list are coherent with an ETF Risk-Parity (All Weather) implementation; it requests no credentials and its network I/O (yfinance/akshare) is consistent with fetching market data.
评估建议
This skill appears to do what it says: fetch historical ETF prices, compute risk-parity weights, and produce tables/charts. Before installing, consider: 1) it requires Python libraries (see requirements.txt) and will make network calls to akshare and yfinance to fetch market data — run it in an environment where outgoing network traffic is acceptable; 2) PDF generation may try to register a local Chinese font (simhei.ttf) or fall back to system fonts — the README mentions a resources/ folder but...详细分析 ▾
✓ 用途与能力
The name/description (All Weather Risk Parity allocator) align with included code: data fetchers (akshare, yfinance), a risk-parity optimizer (scipy minimize SLSQP), metrics calculation, and report generation. The declared requirements (no env vars, no required binaries) match the code's use of Python libraries and no secret/third-party API keys.
ℹ 指令范围
SKILL.md instructs the agent to load scripts/engine.py and run engine.run(), and to interactively ask the user for amount/ETF pool — that matches the code. One minor omission: the SKILL.md does not explicitly state that the code will perform network calls to fetch historical prices (via akshare and yfinance) or that a local Chinese font file (simhei.ttf) is optionally used for PDF generation; these are reasonable but worth calling out so users expect network I/O and possible local file access for fonts.
✓ 安装机制
There is no install spec (instruction-only install) and dependencies are listed in requirements.txt (akshare, yfinance, numpy, pandas, matplotlib, scipy, reportlab, streamlit, altair) — these are consistent with the code. No downloads from arbitrary URLs or archive extraction are present in the manifest.
✓ 凭证需求
The skill requests no environment variables, credentials, or config paths. The code performs network requests to public data providers (akshare/yfinance) but does not attempt to read secrets or unrelated system files.
✓ 持久化与权限
The skill is not always-enabled and does not modify other skills or system-wide settings. It generates files (CSV/PDF) when asked, but does not request persistent elevated privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/14
- Initial release of the All Weather Strategy skill (Professional Edition) - Calculates ETF portfolio weights based on Risk Parity (All Weather) principles - Provides annualized return and risk estimates using historical data - Features default settings with global and domestic ETF pool and CNY support - Includes proactive AI-guided interactions for portfolio customization and advice
● 无害
安装命令
点击复制官方npx clawhub@latest install all-weather-strategy
镜像加速npx clawhub@latest install all-weather-strategy --registry https://cn.longxiaskill.com