中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 22/100
上次扫描：22 小时前 重新扫描
22 /100
hft-paper-trader
High-frequency paper trading framework for crypto. Multi-indicator TA scoring, dual-regime filter, Kelly criterion position sizing, auto-observation logging, and trade ledger.
A legitimate paper trading framework with no malicious code present, but SKILL.md contains undeclared filesystem/network tool usage needed to fulfill its described autonomous-agent role, creating a doc-to-capability mismatch.
tradingpaper-tradinghftcryptokelly
技能名称hft-paper-trader
分析耗时32.7s
引擎pi
✓
可以安装
Add explicit allowed-tools declarations (Binance API calls → network:READ, portfolio/journal writes → filesystem:WRITE) and correct the version mismatch (SKILL.md says v1.1.0, _meta.json says v1.0.0). The skill cannot actually function as described without filesystem and network permissions.

安全发现 2 项

严重性 安全发现 位置
中危
Incomplete tool permissions — autonomous agent cannot function as described 文档欺骗
SKILL.md describes an autonomous hourly trading agent that fetches Binance market data and writes to portfolio.json, journal.json, and observations.md, but declares zero allowed-tools. The skill as described requires network:READ for API calls and filesystem:WRITE for log/portfolio persistence, neither of which are declared.
No allowed-tools declaration in _meta.json
→ Add allowed-tools section to _meta.json: ['Bash', 'Read', 'Write', 'WebFetch'] or equivalent, mapped to filesystem:WRITE and network:READ.
 SKILL.md:1
低危
Version mismatch between SKILL.md and _meta.json 文档欺骗
SKILL.md frontmatter and stop-loss code comment say v1.1.0, but _meta.json and frontmatter published-at timestamp reference v1.0.0. This is a minor inconsistency.
version: 1.1.0 (SKILL.md) vs 1.0.0 (_meta.json)
→ Align version numbers across SKILL.md, _meta.json, and all code comments.
 SKILL.md:1
资源类型声明权限推断权限状态证据
网络访问 NONE READ ✗ 越权 SKILL.md: Binance public API calls for market data — required for described func…
文件系统 NONE WRITE ✗ 越权 SKILL.md: portfolio.json, journal.json, observations.md writes — required for de…
命令执行 NONE NONE — No shell execution detected in any file
环境变量 NONE NONE — No environment variable access detected
技能调用 NONE NONE — No cross-skill invocation detected

目录结构

2 文件 · 3.2 KB · 91 行
Markdown 1f · 86L JSON 1f · 5L
├─ 📋 _meta.json JSON 5L · 135 B
└─ 📝 SKILL.md Markdown 86L · 3.1 KB

安全亮点

✓ No shell commands, subprocess calls, or code execution mechanisms found in any file
✓ No credential harvesting, environment variable iteration, or sensitive path access (~/.ssh, ~/.aws, .env)
✓ No obfuscation (no base64, no eval, no atob patterns)
✓ No supply chain risks — no dependencies, requirements.txt, or package.json present
✓ No persistence mechanisms (no cron, startup hooks, or backdoor installation code)
✓ Binance API usage is explicitly public-only (no API key requirements mentioned)
✓ Trade operations are paper-trading only with no real fund manipulation capability
✓ No hidden HTML comments, injection vectors, or jailbreak instructions