T09 · Insecure Skill Coding Practices
Error
- Location
crypto-news-trader-index.js:128- Finding
Untrusted News Content Can Manipulate Automated Leveraged Trades
- Content
View full analysis
` [Article ${i + 1}] Source: ${a.source} Author: ${a.author || "Unknown"} PublishedAt: ${new Date(a.publishedAt).toISOString()} Title: ${a.title || ""} Content: ${(a.content || a.description || "").slice(0, 700)} URL: ${a.url || ""} Engagement: likes=${a.likes || 0} retweets=${a.retweets || 0} replies=${a.replies || 0} `.trim() ) .join("\n\n---\n\n"); } ``` ```js async analyze(coin, formattedNews) { const prompt = SENTIMENT_ANALYSIS_PROMPT .replaceAll("{COIN}", coin) .replace("{NEWS_CONTENT}", formattedNews); const resp = await this.openai.chat.completions.create({ model: "gpt-4o", temperature: 0.1, max_tokens: 1200, response_format: { type: "json_object" }, messages: [ { role: "system", content: "Return strict JSON only. No markdown. No extra text." }, { role: "user", content: prompt } ] }); return JSON.parse(resp.choices[0].message.content); } ``` ```js const formatted = monitor.formatForLLM(articles); let analysis; try { analysis = await analyzer.analyze(coin, formatted); } catch (e) { console.error(`[Analyzer] Failed:`, e?.message || e); continue; } console.log(`[Analyzer]`, { sentiment: analysis.sentiment, confidence: analysis.confidence, signal_strength: analysis.signal_strength, action: analysis.recommended_action, summary: analysis.summary }); const signal = analyzer.getTradeSignal(analysis); if (!signal) { console.log(`[Decision] No trade.`); continue; } // Step 3 try { await trader.place(coin, signal.side, analysis); } catch (e) { console.error(`[Trade] Failed:`, e?.message || e); } ``` ### Technical ...[truncated 2928 chars]- Remediation
View remediation