T09 · Insecure Skill Coding Practices
- Location
trader.py:345- Finding
Market-context failures bypass live-trading safeguards
- Content
View full analysis
Vulnerability Details
File Location:
trader.py, lines 345–361
Vulnerability Type: Fail-open safety validation
Risk Level: Highpython def get_market_context(market_id: str, my_probability: float = None) -> dict: """Get market context with safeguards and edge analysis.""" try: if my_probability is not None: return get_client()._request( "GET", f"/api/sdk/context/{market_id}", params={"my_probability": my_probability} ) return get_client().get_market_context(market_id) except Exception: return None def check_safeguards(context: dict) -> tuple[bool, list[str]]: """Check context for safeguards. Returns (should_trade, reasons).""" if not context: return True, []Technical Analysis
get_market_context()catches every exception and converts the failure into aNoneresult without recording the underlying cause.check_safeguards()then treats missing context as approval by returning(True, []).Consequently, failure to retrieve or parse market context bypasses all subsequent safeguards, including:
- Resolved-market detection
- Severe flip-flop detection
- Minimum time-to-resolution enforcement
- Minimum-liquidity enforcement
- Maximum-slippage enforcement
This is a fail-open design in a financially privileged execution path. The affected check is used before entry orders and exit orders. In live mode, an approved result allows
execute_trade()to submit an actual order through the Simmer SDK.Attack Path
- The Skill is started with
python trader.py --live. - A trading signal or exit condition is identified.
- Retrieval of
/api/sdk/context/{market_id}fails because of a network interruption, rate limit, malformed response, SDK error, service outage, or deliberate interference with connectivity. get_market_context()suppresses the exceptio ...[truncated 781 chars]
- Remediation
View remediation
Remediation Suggestions
-
Fail closed whenever market context cannot be obtained:
python def check_safeguards(context: dict) -> tuple[bool, list[str]]: if not context: return False, ["Unable to retrieve market context"] -
Preserve a sanitized error reason rather than silently discarding every exception. Do not include API keys, authorization headers, or full sensitive response bodies in logs.
-
Add bounded retries with exponential backoff for transient failures. If all retries fail, skip the order.
-
Validate the response schema before approving a trade. Missing
market,warnings,discipline, orslippagedata should result in rejection where the corresponding control cannot be evaluated. -
Distinguish explicitly between “safeguard passed” and “safeguard unavailable.” Only the former should authorize live execution.
-
Add automated tests covering network exceptions, empty dictionaries, malformed context objects, rate limits, and SDK errors. Each case should verify that no live trade is attempted.
-