T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/recommend.py:54
- Finding
- Documented Betting Safety Controls Are Not Enforced<![CDATA[ ## Vulnerability Details **File Location**: `scripts/recommend.py:54-128`; related configuration at `config/default.json:10-13, 42-44` and claims at `SKILL.md:94-98` **Vulnerability Type**: Missing enforcement of configured financial safety controls **Risk Level**: Medium ### Evidence The default configuration defines session, cooldown, loss, and profit-protection controls: ```json "maxBetsPerSession": 100, "maxSessionMinutes": 120, "cooldownAfterLosses": 5, "cooldownMinutes": 5, ``` ```json "riskManagement": { "maxConsecutiveLosses": 8, "profitLockPercent": 50, "profitLockThreshold": 1.5, "tiltDetection": true, "tiltThreshold": 3 } ``` The documentation presents these controls as active safety features: ```markdown ## Safety Features - **Tilt Detection**: Warns when betting patterns indicate emotional decisions - **Session Limits**: Enforces time and loss limits - **Profit Locking**: Auto-protects portion of winnings - **Reality Checks**: Periodic reminders ``` However, the recommendation interface receives neither session duration nor bet count: ```python def get_recommendation( bankroll: float, current_balance: float, session_profit: float, consecutive_losses: int, recent_history: List[float], strategy: str = "balanced", config: Optional[Dict] = None ) -> BetRecommendation: ``` Only immediate balance thresholds and a consecutive-loss cooldown decision are implemented: ```python # Check stop-loss stop_loss_threshold = bankroll * (1 - config["stopLossPercent"] / 100) if current_balance <= stop_loss_threshold: return BetRecommendation( should_bet=False, amount=0, target_multiplier=0, confidence=100, risk_level="stop", reasoning="Stop-loss triggered. Session should end.", stop_loss_hit=True ) # Check take-profit take_profit_threshold = bankroll * (1 + config["takeProfitPercent"] / 100) if current_balance >= take_profit_threshold: return ...[truncated 3114 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Extend the recommendation state with explicit inputs for: - Session start time or elapsed session duration. - Number of bets placed during the session. - Cooldown start and expiry times. - Locked-profit amount and available betting balance. - Whether a maximum-loss termination state has already been reached. 2. Enforce all limits before any path can return `should_bet=True`: - Stop when `maxBetsPerSession` is reached. - Stop when `maxSessionMinutes` is reached. - Return a terminal session result when `maxConsecutiveLosses` is reached. - Keep returning `should_bet=False` until `cooldownMinutes` has elapsed. - Exclude locked profits from the balance used to calculate bets. 3. Distinguish advisory outcomes from mandatory controls. Introduce explicit result states such as `session_limit`, `cooldown`, `max_losses`, `stop_loss`, and `profit_locked`. 4. Validate configuration values and reject negative, non-finite, contradictory, or out-of-range percentages, durations, balances, and counters. 5. Add unit and integration tests at each boundary, including: - One bet before, exactly at, and one bet after the bet limit. - One minute before, exactly at, and after the duration limit. - Cooldown requests before and after expiry. - Maximum consecutive-loss termination. - Profit-lock calculations and prevention of betting locked funds. 6. Until these controls are implemented, remove or qualify statements that session limits are enforced and profits are automatically protected. Documentation should clearly identify controls that callers must implement independently. ]]>