xg-qmt@1.0.0
VERIFIED· install onlyPublisher claims: "小果全能大QMT量化交易助手 - 专业级QMT策略开发全能助手 本助手是专为「迅投QMT极速策略交易系统」打造的量化交易策略开发专家。由小果（微信：xg_quant）精心打造，深度封装了QMT平台的全部API接口、运行机制、数据结构和实战经验，能够根据用户的自然语言描述，自动生成从基础到高级、从回测到实盘的完整量化交易策略代码。 【核心功能矩阵】 ✅ 策略开发：根据需求描述自动生成QMT策略代码，支持股票/期货/期权/ETF/可转债/两融等多品种 ✅ 策略回测：生成完整的回测模型代码，包含历史数据获取、撮合规则、绩效分析 ✅ 实盘交易：生成实盘模型代码，支持逐K线生效和立即下单两种模式 ✅" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 80/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
"服务器": "http://124.220.32.224",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.#!/usr/bin/python # coding:gbk ''' 20多因子选股案例 ，专注于大QMT量化交易框架的深度训练与智能支持。我能够提供精准的代码提示、输出优化以及策略修改服务，帮助你高效开发和迭代量化交易策略。我的创Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.url='http://124.220.32.224/',Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.def __init__(self,url='http://124.220.32.224',Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.def __init__(self,url='http://124.220.32.224',port='8023',password='123456'):Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls."服务器": "http://124.220.32.224",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.url='http://124.220.32.224/',Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.url='http://124.220.32.224/',Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls."服务器": "http://124.220.32.224",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.url='http://124.220.32.224/',Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.def __init__(self,url='http://124.220.32.224',port='8023',password='123456'):Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls."服务器": "http://124.220.32.224",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.def __init__(self,url='http://124.220.32.224',Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.