📦 Quant Trading Api — 量化交易接口
v1.0.0面向中国市场的专业量化交易API，集成华泰、银河、广发、中信建投等主流券商，提供下单、持仓、行情、账户管理等一站式量化能力，极速接入实盘。
0· 107·2 当前·2 累计
by 下载技能包
最后更新
2026/3/22
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
What to consider before installing:
- Expectation mismatch: the code appears to be a mock/simulator (fake tokens, simulated fills). Do not assume it will connect to real broker APIs without further implementation or verification.
- Credentials handling: SKILL.md suggests putting account/password into config.py (plaintext). That is insecure. Prefer using environment variables or a secret manager and do not commit credentials to source control.
- Undeclared secrets: the skill metadata declares no ...详细分析 ▾
⚠ 用途与能力
The README/SKILL.md states full integration with multiple Chinese brokers, but the included code uses mock implementations (fake tokens, simulated fills, mocked market data) rather than actual authenticated broker API calls. The BROKERS map contains real broker hostnames, but the visible code does not perform real authenticated trading requests. This is a coherence problem: a user expecting a working production connector would not get one from the provided code.
⚠ 指令范围
Instructions ask you to install Python packages and to create a config.py that contains account and password in plaintext. The code reads credentials from constructor args or environment (BROKER_ACCOUNT, BROKER_PASSWORD) but the registry metadata declares no required env vars. The skill therefore instructs/encourages insecure handling of credentials (storing them in repo files) and omits declaring required secrets.
✓ 安装机制
There is no install spec; SKILL.md instructs users to pip install requests, pycryptodome, websocket-client. That is a typical, expected dependency installation for a Python skill. No unusual download URLs or archive extraction were used.
⚠ 凭证需求
The skill clearly needs brokerage credentials to be useful, but the package metadata lists no required environment variables or primary credential. The SKILL.md recommends placing account/password in config.py (a file) and the code falls back to environment variables — a mismatch. Requesting/storing plaintext broker credentials in a file is disproportionate and risky without guidance on secure storage.
✓ 持久化与权限
The skill does not request always:true, does not modify other skills or system-wide configuration, and is user-invocable only. It can be autonomously invoked by the agent by default (platform default), which is expected for skills.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/22
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install quant-trading-api
镜像加速npx clawhub@latest install quant-trading-api --registry https://cn.longxiaskill.com