T09 · Insecure Skill Coding Practices
Error
- Location
trader.py:30- Finding
Documented Financial Risk Controls Are Not Fully Enforced
- Content
View full analysis
= NO_THRESHOLD: conviction = min(1.0, (p - NO_THRESHOLD) / (1 - NO_THRESHOLD) * bias) size = max(MIN_TRADE, round(conviction * MAX_POSITION, 2)) ``` Consequently, a configuration where `MIN_TRADE` exceeds `MAX ...[truncated 3619 chars]- Remediation
View remediation
MAX_POSITION: raise ValueError("SIMMER_MIN_TRADE must not exceed SIMMER_MAX_POSITION") ``` 4. Query the account's existing open positions before trading. Calculate remaining capacity as: ```text remaining = MAX_POSITIONS - current_open_position_count ``` Stop when no portfolio-wide capacity remains. Where possible, make this check atomic or recheck immediately before submission to avoid concurrent-run races. 5. Decide whether `MAX_POSITIONS` means open markets, orders, or aggregate positions and enforce that definition consistently. 6. Make all defaults identical across `SKILL.md`, `clawhub.json`, and `trader.py`. Prefer a single configuration source to prevent future drift. 7. Validate all numeric environment variables at startup, including finite-value checks, valid threshold ordering, nonnegative amounts, and supported upper bounds. 8. Add automated tests proving that low-volume markets are skipped, existing positions are counted, conflicting tunables are rejected, and no submitted amount exceeds `MAX_POSITION`. ]]>