中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 25/100
上次扫描：1 天前 重新扫描
25 /100
skill-smc-multi-strategy-paper-trader
Paper trading monitors for SMC + Macro Rotation strategies. Binance public API only.
A legitimate paper trading system with mostly declared capabilities, but with two significant undeclared behaviors: GitHub API integration (pushes portfolio data externally) and shell execution via execSync/curl for FRED data fetching. Neither is outright malicious but both represent documentation deception and hidden functionality.
技能名称skill-smc-multi-strategy-paper-trader
分析耗时68.2s
引擎pi
✓
可以安装
Declare GitHub API integration and shell/execSync usage explicitly in SKILL.md. The GitHub push behavior (data exfiltration to third-party repo) must be documented. Consider using Node's built-in https module instead of execSync/curl for FRED data.

安全发现 4 项

严重性 安全发现 位置
中危
GitHub API integration entirely undeclared 文档欺骗
All 7 scripts read ~/.github_token and push portfolio JSON files (portfolio-v5.json, portfolio-v6.json, portfolio-swing.json, portfolio-swing-v2.json, portfolio-coordinated.json, portfolio-macro.json) to the GitHub repository Zero2Ai-hub/Jarvis-Ops. This is a major external data flow completely absent from SKILL.md.
const ghToken = fs.readFileSync(path.join(process.env.HOME, '.github_token'), 'utf8').trim();
→ Declare GitHub API push as a capability. State that portfolio data is pushed to a linked GitHub repo for dashboard synchronization.
 scripts/macro-rotation.js:724
中危
Shell/execSync execution undeclared 文档欺骗
regime-scorer.js (line ~146) and macro-rotation.js (line ~68) use child_process.execSync to run curl for fetching FRED CSV data. While SKILL.md mentions fetching FRED data, it does not disclose the execSync/curl method.
const csv = execSync(`curl -sL --max-time 12 "${url}"`, { encoding: 'utf8', timeout: 15000 });
→ Either document execSync usage or replace with Node.js native https fetch (available since Node 18). This avoids shell injection risks and removes the execSync dependency.
 scripts/regime-scorer.js:146
低危
SKILL.md claims 'no credentials needed' while reading GitHub token 文档欺骗
The main SKILL.md states 'Binance public API only — no credentials needed' and 'no account or API key required'. However, every script reads a GitHub token from ~/.github_token for API authentication. While the token is a filesystem credential (not a trading credential), the claim is technically misleading.
Binance public API only — no credentials needed.
→ Reframe to clarify: no trading account credentials are needed, but a GitHub token is required for dashboard sync.
 SKILL.md:1
低危
Portfolio data pushed to third-party GitHub repository 数据外泄
Each run, scripts push complete portfolio state (open positions, closed trades, P&L metrics, strategy parameters) to an external GitHub repository (Zero2Ai-hub/Jarvis-Ops). While the data is trading-related and not credentials, this external data flow is not declared.
execSync(`curl -sL -X PUT -H "Authorization: token ${ghToken}" ... https://api.github.com/repos/Zero2Ai-hub/Jarvis-Ops/...`
→ Document the GitHub repository destination and what data is synced. Consider encryption or signing of pushed data.
 scripts/macro-rotation.js:731
资源类型声明权限推断权限状态证据
网络访问 READ WRITE ✗ 越权 All 7 scripts push portfolio JSON via GitHub API PUT (macro-rotation.js:724, pap…
命令执行 NONE WRITE ✗ 越权 regime-scorer.js:146, macro-rotation.js:68 execSync('curl -sL ...') for FRED CSV
文件系统 WRITE WRITE ✓ 一致 Writes portfolio JSON to ~/.openclaw/workspace/trading/ — declared in architectu…
环境变量 NONE READ ✗ 越权 All scripts read HOME env var (process.env.HOME) and ~/.github_token file for Gi…
技能调用 NONE READ ✓ 一致 Scripts read regime.json (created by regime-scorer.js) and orchestrator-lock.jso…
13 项发现
🔗
中危 外部 URL 外部 URL
https://fred.stlouisfed.org/graph/fredgraph.csv?id=$
scripts/macro-rotation.js:68
🔗
中危 外部 URL 外部 URL
https://fapi.binance.com/fapi/v1/klines?symbol=$
scripts/macro-rotation.js:77
🔗
中危 外部 URL 外部 URL
https://fapi.binance.com/fapi/v1/fundingRate?symbol=$
scripts/macro-rotation.js:83
🔗
中危 外部 URL 外部 URL
https://fapi.binance.com/futures/data/globalLongShortAccountRatio?symbol=$
scripts/macro-rotation.js:87
🔗
中危 外部 URL 外部 URL
https://fapi.binance.com/futures/data/openInterestHist?symbol=$
scripts/macro-rotation.js:91
🔗
中危 外部 URL 外部 URL
https://api.alternative.me/fng/?limit=30
scripts/macro-rotation.js:95
🔗
中危 外部 URL 外部 URL
https://fapi.binance.com/fapi/v1/ticker/price?symbol=$
scripts/macro-rotation.js:707
🔗
中危 外部 URL 外部 URL
https://fapi.binance.com/fapi/v1/klines?symbol=BTCUSDT&interval=4h&limit=60
scripts/paper-monitor-coordinated.js:89
🔗
中危 外部 URL 外部 URL
https://fapi.binance.com/fapi/v1/klines?symbol=BTCUSDT&interval=15m&limit=30
scripts/paper-monitor-coordinated.js:97
🔗
中危 外部 URL 外部 URL
https://fapi.binance.com/fapi/v1/klines?symbol=BTCUSDT&interval=1d&limit=60
scripts/paper-monitor-coordinated.js:108
🔗
中危 外部 URL 外部 URL
https://fapi.binance.com/fapi/v1/fundingRate?symbol=BTCUSDT&limit=30
scripts/regime-scorer.js:753
🔗
中危 外部 URL 外部 URL
https://fapi.binance.com/futures/data/globalLongShortAccountRatio?symbol=BTCUSDT&period=4h&limit=30
scripts/regime-scorer.js:754
🔗
中危 外部 URL 外部 URL
https://fapi.binance.com/futures/data/openInterestHist?symbol=BTCUSDT&period=4h&limit=30
scripts/regime-scorer.js:755

目录结构

9 文件 · 188.6 KB · 4472 行
JavaScript 7f · 4240L Markdown 2f · 232L
├─ ▾ 📁 public
│ └─ 📝 SKILL.md Markdown 76L · 3.0 KB
├─ ▾ 📁 scripts
│ ├─ 📜 macro-rotation.js JavaScript 876L · 38.0 KB
│ ├─ 📜 paper-monitor-coordinated.js JavaScript 401L · 20.7 KB
│ ├─ 📜 paper-monitor-swing-v2.js JavaScript 486L · 20.1 KB
│ ├─ 📜 paper-monitor-swing.js JavaScript 511L · 20.8 KB
│ ├─ 📜 paper-monitor-v5.js JavaScript 561L · 21.2 KB
│ ├─ 📜 paper-monitor-v6.js JavaScript 528L · 19.8 KB
│ └─ 📜 regime-scorer.js JavaScript 877L · 39.3 KB
└─ 📝 SKILL.md Markdown 156L · 5.5 KB

依赖分析 3 项

包名版本来源已知漏洞备注
https (built-in Node.js) bundled Node.js stdlib 否 No external npm dependencies — uses only Node.js built-in modules
fs (built-in Node.js) bundled Node.js stdlib 否 No external npm dependencies
child_process (built-in Node.js) bundled Node.js stdlib 否 execSync used for FRED curl — should be replaced with native https fetch

安全亮点

✓ All Binance API calls use only public endpoints — no authentication or private data access
✓ No credential harvesting or exfiltration — the GitHub token is read locally, not transmitted anywhere else
✓ No obfuscation, base64 payloads, or anti-analysis techniques observed
✓ Portfolio files stored in a dedicated workspace path (~/.openclaw/workspace/trading/) — not scattered across filesystem
✓ Comprehensive technical implementation with proper risk management (SL/TP/ATR-based stops)
✓ No sensitive paths accessed (~/.ssh, ~/.aws, .env, etc.)
✓ GitHub push failures are gracefully handled with try/catch and non-critical error logging
✓ Orchestrator lock prevents same-symbol conflicts across strategies