📦 Signal Generator — 交易信号生成
v1.0.0基于布林带突破或RSI反转策略生成交易信号，并自动推送至Discord、Telegram或自定义频道。
0· 1.8k·2 当前·2 累计
by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill produces trading signals locally and saves them to last_signal.json, but it does not itself send messages to Discord/Telegram despite the documentation saying it will. Before installing or running: 1) Do not assume it will post to external channels — inspect or add delivery code that uses secure storage of API tokens if you want that behavior. 2) Review any /root/quant-trading-bot repository on your system: the script inserts '/root/quant-trading-bot' onto sys.path and may import code...详细分析 ▾
⚠ 用途与能力
SKILL.md and README claim the skill will 'send alerts to Discord/Telegram' and accept 'targets' in config, but signal_generator.py never implements network posting or uses the 'targets' configuration — it only writes last_signal.json. The code does implement data fetching and indicator calculations (ccxt/binance for public OHLCV), which fits the signal-generation purpose. However, the script also force-inserts '/root/quant-trading-bot' onto sys.path and run.sh/README reference a /root/quant-trading-bot venv — this external dependency on a host path is unexpected for a standalone skill and not justified by the documentation.
⚠ 指令范围
Runtime instructions tell the user to configure channel IDs and imply the skill will send alerts; the code only formats messages and saves signals to last_signal.json. SKILL.md's troubleshooting explicitly directs checking /root/quant-trading-bot, which means the runtime behavior can depend on files outside the skill directory. The instructions do not request tokens/credentials for Discord/Telegram, nor do they explain how those targets will be used, leaving ambiguity and possible scope creep (relying on external system integration).
ℹ 安装机制
There is no install spec (instruction-only), so nothing is downloaded by an installer. That's low risk. However, package.json and run.sh reference Python packages and a /root/quant-trading-bot venv, which suggests the author expects a specific host environment; that is unconventional but not directly malicious.
⚠ 凭证需求
The skill declares no required env vars or credentials, yet advertises sending alerts to Discord/Telegram. If users expect autonomous sending, tokens would normally be required — their absence indicates either (a) the skill expects OpenClaw to perform delivery from last_signal.json, or (b) the implementation is incomplete. Additionally, modifying sys.path to include '/root/quant-trading-bot' lets the skill import arbitrary code from that host path, which could expose or reuse credentials and is disproportionate for a simple signal generator.
✓ 持久化与权限
The skill is not marked always:true and does not request system-wide configuration changes. It writes last_signal.json in its own directory and otherwise does not persist or alter other skills. Autonomous invocation is allowed (default) but not a special privilege here.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/2
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install signal-generator
镜像加速npx clawhub@latest install signal-generator --registry https://cn.longxiaskill.com