中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 25/100
Last scan:1 day ago Rescan
25 /100
skill-smc-multi-strategy-paper-trader
Paper trading monitors for SMC + Macro Rotation strategies. Binance public API only.
A legitimate paper trading system with mostly declared capabilities, but with two significant undeclared behaviors: GitHub API integration (pushes portfolio data externally) and shell execution via execSync/curl for FRED data fetching. Neither is outright malicious but both represent documentation deception and hidden functionality.
Skill Nameskill-smc-multi-strategy-paper-trader
Duration68.2s
Enginepi
✓
Safe to install
Declare GitHub API integration and shell/execSync usage explicitly in SKILL.md. The GitHub push behavior (data exfiltration to third-party repo) must be documented. Consider using Node's built-in https module instead of execSync/curl for FRED data.

Findings 4 items

Severity Finding Location
Medium
GitHub API integration entirely undeclared Doc Mismatch
All 7 scripts read ~/.github_token and push portfolio JSON files (portfolio-v5.json, portfolio-v6.json, portfolio-swing.json, portfolio-swing-v2.json, portfolio-coordinated.json, portfolio-macro.json) to the GitHub repository Zero2Ai-hub/Jarvis-Ops. This is a major external data flow completely absent from SKILL.md.
const ghToken = fs.readFileSync(path.join(process.env.HOME, '.github_token'), 'utf8').trim();
→ Declare GitHub API push as a capability. State that portfolio data is pushed to a linked GitHub repo for dashboard synchronization.
 scripts/macro-rotation.js:724
Medium
Shell/execSync execution undeclared Doc Mismatch
regime-scorer.js (line ~146) and macro-rotation.js (line ~68) use child_process.execSync to run curl for fetching FRED CSV data. While SKILL.md mentions fetching FRED data, it does not disclose the execSync/curl method.
const csv = execSync(`curl -sL --max-time 12 "${url}"`, { encoding: 'utf8', timeout: 15000 });
→ Either document execSync usage or replace with Node.js native https fetch (available since Node 18). This avoids shell injection risks and removes the execSync dependency.
 scripts/regime-scorer.js:146
Low
SKILL.md claims 'no credentials needed' while reading GitHub token Doc Mismatch
The main SKILL.md states 'Binance public API only — no credentials needed' and 'no account or API key required'. However, every script reads a GitHub token from ~/.github_token for API authentication. While the token is a filesystem credential (not a trading credential), the claim is technically misleading.
Binance public API only — no credentials needed.
→ Reframe to clarify: no trading account credentials are needed, but a GitHub token is required for dashboard sync.
 SKILL.md:1
Low
Portfolio data pushed to third-party GitHub repository Data Exfil
Each run, scripts push complete portfolio state (open positions, closed trades, P&L metrics, strategy parameters) to an external GitHub repository (Zero2Ai-hub/Jarvis-Ops). While the data is trading-related and not credentials, this external data flow is not declared.
execSync(`curl -sL -X PUT -H "Authorization: token ${ghToken}" ... https://api.github.com/repos/Zero2Ai-hub/Jarvis-Ops/...`
→ Document the GitHub repository destination and what data is synced. Consider encryption or signing of pushed data.
 scripts/macro-rotation.js:731
ResourceDeclaredInferredStatusEvidence
Network READ WRITE ✗ Violation All 7 scripts push portfolio JSON via GitHub API PUT (macro-rotation.js:724, pap…
Shell NONE WRITE ✗ Violation regime-scorer.js:146, macro-rotation.js:68 execSync('curl -sL ...') for FRED CSV
Filesystem WRITE WRITE ✓ Aligned Writes portfolio JSON to ~/.openclaw/workspace/trading/ — declared in architectu…
Environment NONE READ ✗ Violation All scripts read HOME env var (process.env.HOME) and ~/.github_token file for Gi…
Skill Invoke NONE READ ✓ Aligned Scripts read regime.json (created by regime-scorer.js) and orchestrator-lock.jso…
13 findings
🔗
Medium External URL 外部 URL
https://fred.stlouisfed.org/graph/fredgraph.csv?id=$
scripts/macro-rotation.js:68
🔗
Medium External URL 外部 URL
https://fapi.binance.com/fapi/v1/klines?symbol=$
scripts/macro-rotation.js:77
🔗
Medium External URL 外部 URL
https://fapi.binance.com/fapi/v1/fundingRate?symbol=$
scripts/macro-rotation.js:83
🔗
Medium External URL 外部 URL
https://fapi.binance.com/futures/data/globalLongShortAccountRatio?symbol=$
scripts/macro-rotation.js:87
🔗
Medium External URL 外部 URL
https://fapi.binance.com/futures/data/openInterestHist?symbol=$
scripts/macro-rotation.js:91
🔗
Medium External URL 外部 URL
https://api.alternative.me/fng/?limit=30
scripts/macro-rotation.js:95
🔗
Medium External URL 外部 URL
https://fapi.binance.com/fapi/v1/ticker/price?symbol=$
scripts/macro-rotation.js:707
🔗
Medium External URL 外部 URL
https://fapi.binance.com/fapi/v1/klines?symbol=BTCUSDT&interval=4h&limit=60
scripts/paper-monitor-coordinated.js:89
🔗
Medium External URL 外部 URL
https://fapi.binance.com/fapi/v1/klines?symbol=BTCUSDT&interval=15m&limit=30
scripts/paper-monitor-coordinated.js:97
🔗
Medium External URL 外部 URL
https://fapi.binance.com/fapi/v1/klines?symbol=BTCUSDT&interval=1d&limit=60
scripts/paper-monitor-coordinated.js:108
🔗
Medium External URL 外部 URL
https://fapi.binance.com/fapi/v1/fundingRate?symbol=BTCUSDT&limit=30
scripts/regime-scorer.js:753
🔗
Medium External URL 外部 URL
https://fapi.binance.com/futures/data/globalLongShortAccountRatio?symbol=BTCUSDT&period=4h&limit=30
scripts/regime-scorer.js:754
🔗
Medium External URL 外部 URL
https://fapi.binance.com/futures/data/openInterestHist?symbol=BTCUSDT&period=4h&limit=30
scripts/regime-scorer.js:755

File Tree

9 files · 188.6 KB · 4472 lines
JavaScript 7f · 4240L Markdown 2f · 232L
├─ ▾ 📁 public
│ └─ 📝 SKILL.md Markdown 76L · 3.0 KB
├─ ▾ 📁 scripts
│ ├─ 📜 macro-rotation.js JavaScript 876L · 38.0 KB
│ ├─ 📜 paper-monitor-coordinated.js JavaScript 401L · 20.7 KB
│ ├─ 📜 paper-monitor-swing-v2.js JavaScript 486L · 20.1 KB
│ ├─ 📜 paper-monitor-swing.js JavaScript 511L · 20.8 KB
│ ├─ 📜 paper-monitor-v5.js JavaScript 561L · 21.2 KB
│ ├─ 📜 paper-monitor-v6.js JavaScript 528L · 19.8 KB
│ └─ 📜 regime-scorer.js JavaScript 877L · 39.3 KB
└─ 📝 SKILL.md Markdown 156L · 5.5 KB

Dependencies 3 items

PackageVersionSourceKnown VulnsNotes
https (built-in Node.js) bundled Node.js stdlib No No external npm dependencies — uses only Node.js built-in modules
fs (built-in Node.js) bundled Node.js stdlib No No external npm dependencies
child_process (built-in Node.js) bundled Node.js stdlib No execSync used for FRED curl — should be replaced with native https fetch

Security Positives

✓ All Binance API calls use only public endpoints — no authentication or private data access
✓ No credential harvesting or exfiltration — the GitHub token is read locally, not transmitted anywhere else
✓ No obfuscation, base64 payloads, or anti-analysis techniques observed
✓ Portfolio files stored in a dedicated workspace path (~/.openclaw/workspace/trading/) — not scattered across filesystem
✓ Comprehensive technical implementation with proper risk management (SL/TP/ATR-based stops)
✓ No sensitive paths accessed (~/.ssh, ~/.aws, .env, etc.)
✓ GitHub push failures are gracefully handled with try/catch and non-critical error logging
✓ Orchestrator lock prevents same-symbol conflicts across strategies