setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited setup (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Set up the complete Python backtesting environment for VectorBT + OpenAlgo.
$0 = Python version (optional, default: python3). Examples: python3.12, python3.13Run the following to detect the OS:
uname -s 2>/dev/null || echo "Windows"Map the result:
Darwin = macOSLinux = LinuxMINGW* or CYGWIN* or Windows = WindowsPrint the detected OS to the user.
Create a Python virtual environment in the current working directory:
macOS / Linux:
python3 -m venv venv
source venv/bin/activate
pip install --upgrade pipWindows:
python -m venv venv
venv\Scripts\activate
pip install --upgrade pipIf the user specified a Python version argument, use that instead of python3:
$PYTHON_VERSION -m venv venvTA-Lib requires a C library installed at the OS level BEFORE pip install ta-lib.
macOS:
brew install ta-libLinux (Debian/Ubuntu):
sudo apt-get update
sudo apt-get install -y build-essential wget
wget http://prdownloads.sourceforge.net/ta-lib/ta-lib-0.4.0-src.tar.gz
tar -xzf ta-lib-0.4.0-src.tar.gz
cd ta-lib/
./configure --prefix=/usr
make
sudo make install
cd ..
rm -rf ta-lib ta-lib-0.4.0-src.tar.gzLinux (RHEL/CentOS/Fedora):
sudo yum groupinstall -y "Development Tools"
wget http://prdownloads.sourceforge.net/ta-lib/ta-lib-0.4.0-src.tar.gz
tar -xzf ta-lib-0.4.0-src.tar.gz
cd ta-lib/
./configure --prefix=/usr
make
sudo make install
cd ..
rm -rf ta-lib ta-lib-0.4.0-src.tar.gzWindows:
pip install ta-libIf that fails, download the appropriate .whl file from https://github.com/cgohlke/talib-build/releases and install with:
pip install TA_Lib-0.4.32-cp312-cp312-win_amd64.whlInstall all required packages (latest versions):
pip install openalgo vectorbt plotly anywidget nbformat ta-lib pandas numpy yfinance python-dotenv tqdm scipy numba nbformat ipywidgets quantstats ccxt duckdb psutilCreate only the top-level backtesting directory. Strategy subfolders are created on-demand when a backtest script is generated (by the /backtest skill).
mkdir -p backtestingDo NOT pre-create strategy subfolders.
6a. Check if `.env.sample` exists at the project root. If it does, use it as a template.
6b. Ask the user which markets they will be backtesting using AskUserQuestion:
6c. If the user selected Indian Markets, ask for their OpenAlgo API key:
.env6d. If the user selected Indian Markets (DuckDB), ask for the DuckDB database path:
market_data table with symbol, exchange, interval, timestamp columns, it is OpenAlgo Historify format (store as HISTORIFY_DB_PATH). Otherwise store as DUCKDB_PATH.6e. If the user selected Crypto Markets, ask if they want to configure exchange API keys:
.env.env6f. Write the `.env` file in the project root directory. Use this template, filling in any keys/paths the user provided:
# Indian Markets (OpenAlgo)
OPENALGO_API_KEY={user_provided_key or "your_openalgo_api_key_here"}
OPENALGO_HOST=http://127.0.0.1:5000
# DuckDB Data Sources (direct database loading - fastest)
# Custom DuckDB (user-created with OHLCV table)
DUCKDB_PATH={user_provided_path or ""}
# OpenAlgo Historify DuckDB (market_data table with epoch timestamps)
HISTORIFY_DB_PATH={user_provided_path or ""}
# Crypto Markets (CCXT) - Optional
CRYPTO_API_KEY={user_provided_key or ""}
CRYPTO_SECRET_KEY={user_provided_key or ""}6g. Add `.env` to `.gitignore` if it exists (never commit secrets):
Scripts use find_dotenv() to automatically walk up and find the single root .env, so no copies are needed in subdirectories.
grep -qxF '.env' .gitignore 2>/dev/null || echo '.env' >> .gitignoreRun a quick verification:
python -c "
import vectorbt as vbt
import openalgo
import plotly
import talib
import duckdb
import anywidget
import nbformat
import quantstats as qs
from dotenv import load_dotenv
print('All packages installed successfully')
print(f' vectorbt: {vbt.__version__}')
print(f' plotly: {plotly.__version__}')
print(f' duckdb: {duckdb.__version__}')
print(f' nbformat: {nbformat.__version__}')
print(f' quantstats: {qs.__version__}')
print(f' TA-Lib: available')
print(f' python-dotenv: available')
"If TA-Lib import fails, inform the user that the C library needs to be installed first (see Step 3).
Print a summary showing:
/backtest).env file status (configured with keys / placeholder) — single file at project rootcp .env.sample .env and fill in API keys if you skipped configuration"brew install ta-lib.env files — they contain secrets. Always use .gitignore..env — do not ask them to edit the file manuallypython-dotenv is included in the pip install and must be used by all scripts to load .env~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.