ClawHub
Back to skill

Security audit

Crypto Executor Optimizer

Security checks for vulnerabilities and agentic risk

Overview

This skill openly automates a crypto trading bot, but it also downloads mutable code, stores exchange credentials, modifies executable trading logic, restarts services, and installs recurring execution with weak guardrails.

Review this carefully before installing. Only use it with tightly scoped Binance API keys, withdrawals disabled, limited capital, and a dedicated unprivileged account. Do not run the setup until downloaded code is pinned or verified, credentials are stored as data rather than sourced shell, optimizer inputs are validated, and recurring cron execution is explicitly acceptable for your trading risk.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (7)

T03 · Remote Payload Retrieval and Execution

Error
Location
setup_binance_20euros.sh:37
Finding

Mutable Remote Trading Code Is Downloaded and Executed Without Integrity Verification

Content
View full analysis
/dev/null; then sudo systemctl start crypto-executor # ... fi nohup python3 "$EXECUTOR_PATH" > /workspace/logs/binance_bot.log 2>&1 & ``` ### Technical Analysis Both Python programs are retrieved from the mutable `main` branches of personal GitHub repositories. No commit pin, release signature, expected SHA-256 digest, content validation, or review gate is enforced. Checking only whether the destination file exists does not establish that the download succeeded completely or that its contents are trustworthy. The main executor is then run with Binance credentials loaded into its environment. Project documentation also states that the ora ...[truncated 1667 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
apply_optimization.sh:88
Finding

Optimizer Arguments Are Interpolated Directly Into Executable Python Source

Content
View full analysis
0: changes.append(f"{label}: → {new_val}") return new_code if "$OBI_SCALPING": code = replace_val(code, r'if obi > ([\d.]+) and spread_bps', "$OBI_SCALPING", "OBI scalping") if "$OBI_MOMENTUM": code = replace_val(code, r'if obi > ([\d.]+) and price_change', "$OBI_MOMENTUM", "OBI momentum") if "$PRICE_CHANGE": code = replace_val(code, r'price_change > ([\d.]+)', "$PRICE_CHANGE", "price_change trigger") if "$SPREAD_BPS": code = replace_val(code, r'spread_bps < ([\d.]+)', "$SPREAD_BPS", "spread_bps filter") if "$KELLY_FACTOR": code = replace_val(code, r'kelly \* ([\d.]+)', "$KELLY_FACTOR", "Kelly factor") ``` ### Technical Analysis The here-document delimiter is unquoted, so shell variables are expanded into the Python program before Python executes it. Values parsed from command-line arguments are inserted into Python string literals and `if` statements without escaping. A value containing quotes, newlines, or Python syntax can terminate the intended string and inject statements into the temporary Python program. This code runs before `py_compile` validates the modified executor, so syntax validation does not prevent execution of the injected optimizer payload. The script also does not enforce the numeric types or documented mi ...[truncated 1857 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
setup_binance_20euros.sh:120
Finding

Credential Values Are Written as Shell Code and Later Sourced

Content
View full analysis
"$CONFIG_FILE" << EOF # Binance Bot Configuration — Generated $(date) # ⚠️ chmod 600 this file BINANCE_API_KEY="$BINANCE_API_KEY" BINANCE_API_SECRET="$BINANCE_API_SECRET" TELEGRAM_BOT_TOKEN="$TELEGRAM_BOT_TOKEN" TELEGRAM_CHAT_ID="$TELEGRAM_CHAT_ID" # Capital & Position Sizing (20€ conservative) MAX_POSITION_SIZE_PCT="12" DAILY_LOSS_LIMIT_PCT="2" WEEKLY_LOSS_LIMIT_PCT="5" DRAWDOWN_PAUSE_PCT="7" DRAWDOWN_KILL_PCT="10" EOF chmod 600 "$CONFIG_FILE" ``` The generated file is executed as shell syntax: ```bash source "$CONFIG_FILE" ``` It is also sourced during optimizer fallback restart: ```bash if [ -f "/workspace/data/bot_config.env" ]; then source /workspace/data/bot_config.env fi ``` ### Technical Analysis Credential values are embedded verbatim inside double-quoted shell assignments. A value containing a double quote followed by a newline can terminate the assignment and add arbitrary shell commands to the generated file. `chmod 600` protects the file from other local users, but it does not make its contents safe to execute. Every subsequent `source` treats the file as code rather than data. This converts malformed, attacker-supplied, or compromised configuration content into shell command execution. The setup also sources the file before directly launching the downloaded executor, and the optimizer repeatedly sources it whenever the systemd restart path fails. ### Attack Path 1. A malicious value is supplied through an inherited environment variable or interactive credential input, or a process with access to the user's workspace modifies `bot_config.env`. 2. The value closes the generated shell quote and inserts a command on a new l ...[truncated 809 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
setup_binance_20euros.sh:89
Finding

Binance API Secret Is Collected With Terminal Echo Enabled

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Error
Location
install_cron.sh:29
Finding

Recurring Autonomous Trading Optimizer Is Installed as Persistent Cron Execution

Content
View full analysis
> /workspace/logs/cron.log 2>&1" (crontab -l 2>/dev/null | grep -v crypto-executor-optimizer; echo "# Wesley Optimizer") | crontab - (crontab -l 2>/dev/null; echo "$CRON_LINE") | crontab - echo "✅ Cron système installé en fallback" fi ``` ### Technical Analysis Persistence is part of the Skill's declared autonomous functionality, so the presence of a recurring job is not hidden. Nevertheless, it creates a high-impact cross-session execution path: every six hours an agent is instructed to read mutable local files, decide how to alter a live trading program, invoke the optimizer, and restart the bot. The fallback is activated for every nonzero result from `openclaw cron add`, not only when the CLI is unavailable. Authentication errors, invalid configuration, or temporary failures therefore cause installation into a separate persistence mechanism. The fallback uses an unqualified `openclaw` command name, relying on cron's `PATH` resolution. It also provides no duplicate-safe, exact entry management beyond removing every existing line containing the Skill identifier. The installer reports success without verifying the resulting crontab entry. Its displayed uninstall command covers Open ...[truncated 1445 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
apply_optimization.sh:187
Finding

Restart Failure Does Not Trigger the Documented Rollback

Content
View full analysis
/dev/null if systemctl is-active --quiet crypto-executor 2>/dev/null; then log "✅ Bot restarted via systemd" RESTART_OK=true else log "systemd unavailable, using pkill fallback..." pkill -f "executor.py" 2>/dev/null sleep 3 if [ -f "/workspace/data/bot_config.env" ]; then source /workspace/data/bot_config.env fi nohup python3 "$EXECUTOR_PATH" >> /workspace/logs/binance_bot.log 2>&1 & sleep 3 if pgrep -f "executor.py" > /dev/null; then log "✅ Bot restarted via pkill fallback" RESTART_OK=true else log "❌ Bot failed to restart" RESTART_OK=false fi fi # ... log "========================================" log "OPTIMIZATION COMPLETE ✅" log "========================================" ``` ### Technical Analysis Project documentation states that a failed restart causes automatic rollback. The implementation only restores the backup after source-modification errors or Python syntax errors. When both restart mechanisms fail, it sets `RESTART_OK=false` but does not restore `BACKUP_PATH`, retry the previous version, or exit with a failure status. The script subsequently logs “OPTIMIZATION COMPLETE” and normally exits successfully. This can cause schedulers and operators to treat a failed deployment as successful. `py_compile` checks only Python syntax. It cannot identify missing imports, initialization errors, invalid numeric policy, incompatible runtime assumptions, or failures caused by the modified business logic. The broad `pkill -f "executor.py"` fallback may also terminate unrelated processes whose command lines contain the same filename. ### Attack Path 1. The optimizer writes a syntactically valid but operationally invalid or unsafe ...[truncated 892 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
setup_binance_20euros.sh:75
Finding

Unpinned Package Is Installed Into the System Python Environment

Content
View full analysis
/dev/null; then echo "📦 Installing websocket-client (for sub-100ms streams)..." pip install websocket-client --break-system-packages --quiet # On VPS/standard server: prefer → python3 -m venv venv && source venv/bin/activate && pip install websocket-client echo "✅ websocket-client installed" else echo "✅ websocket-client available" fi ``` ### Technical Analysis The dependency has no exact version or integrity hash. Installation therefore resolves whatever package version and transitive dependencies the package index serves at setup time. `--break-system-packages` bypasses Python's externally-managed-environment protection and can alter the interpreter environment used by unrelated applications when permissions allow. The script also invokes `pip` separately from `python3`, so `pip` may target a different interpreter. Finally, it prints a success message without checking the installation command's exit status or verifying the installed module version and origin. The package name appears legitimate; the risk arises from mutable, unpinned dependency resolution and modification of a shared interpreter, not from evidence of typosquatting in the audited files. ### Attack Path 1. The expected `websocket` module is absent. 2. Setup resolves `websocket-client` and its dependencies from the configured package index. 3. A compromised index, account, mirror, DNS/proxy configuration, or future malicious release supplies altered package content. 4. Package installation code executes during installation and the package is later imported by the trading bot. 5. The package gains access to the bot process environment, including credentials. 6. Shared-system installation may also affect other Py ...[truncated 401 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (55)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared purpose focuses on tuning parameters, yet the documented setup downloads remote code from GitHub, installs Python packages, stores credentials, and controls services and processes. Combining remote code acquisition with privileged lifecycle control materially expands the attack surface and can lead to arbitrary code execution or unauthorized persistent changes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The declared purpose focuses on tuning parameters, yet the documented setup downloads remote code from GitHub, installs Python packages, stores credentials, and controls services and processes. Combining remote code acquisition with privileged lifecycle control materially expands the attack surface and can lead to arbitrary code execution or unauthorized persistent changes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose focuses on tuning parameters, yet the documented setup downloads remote code from GitHub, installs Python packages, stores credentials, and controls services and processes. Combining remote code acquisition with privileged lifecycle control materially expands the attack surface and can lead to arbitrary code execution or unauthorized persistent changes.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 287)May include surrounding context.

valide

  • Rollback automatique si restart échoué
  • Conservation des 5 derniers backups uniquement
  • Alerte Telegram en cas d'erreur

📅 Cron & Persistance

Le skill installe un job récurrent via install_cron.sh :

bash
# Schedule : toutes les 6h
0 */6 * * *

# Via OpenClaw cron (prioritaire) :
openclaw cron add --name "crypto-executor-optimizer" --cron "0 */6 * * *"

# Via system crontab (fallback si openclaw CLI indisponible) :
0 */6 * * * openclaw run --skill crypto-executor-optimizer

Désinstaller le cron :

bash
openclaw cron remove --name crypto-executor-optimizer
# OU
crontab -e  # supprimer la ligne crypto-executor-optimizer

📁 Fichiers importants

FichierRôle
/workspace/performance_metrics.jsonStats de performance du bot
/workspace/learned_config.jsonHistorique des configurations précédentes
/workspace/skills/crypto-executor/executor.pyLe bot à optimiser
/workspace/data/bot_config.env

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · apply_optimization.sh (reported line 233)May include surrounding context.

sh
BACKUP_COUNT=$(ls "$BACKUP_DIR"/executor_backup_*.py 2>/dev/null | wc -l)
if [ "$BACKUP_COUNT" -gt 5 ]; then
    ls -t "$BACKUP_DIR"/executor_backup_*.py | tail -n +6 | xargs rm -f
    log "Old backups cleaned (kept last 5)"
fi

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · install_cron.sh (reported line 46)May include surrounding context.

sh
-executor-optimizer skill. Read /workspace/performance_metrics.json and /workspace/skills/crypto-executor/executor.py, analyze performance, decide what to optimize, then call apply_optimization.sh with the new values."

if [ $? -eq 0 ]; then
    echo "✅ Cron OpenClaw installé (toutes les 6h)"
else
    echo "⚠️  openclaw CLI non disponible. Fallback crontab système..."
    
    # Fallback: crontab système qui demande à Wesley via openclaw
    CRON_LINE="0 */6 * * * openclaw run --skill crypto-executor-optimizer >> /workspace/logs/cron.log 2>&1"
    (crontab -l 2>/dev/null | grep -v crypto-executor-optimizer; echo "# Wesley Optimizer") | crontab -
    (crontab -l 2>/dev/null; echo "$CRON_LINE") | crontab -
    echo "✅ Cron système installé en fallback"
fi

echo ""
echo "========================================"
echo "INSTALLATION COMPLETE"
echo "========================================"
echo ""
echo "📅 Schedule : toutes les 6h (00:00, 06:00, 12:00, 18:00)"
echo ""
echo "

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script's behavior far exceeds the declared role of an optimizer: it installs code, collects exchange and Telegram credentials, writes persistent configuration, stops existing services, and launches trading software. This capability expansion is dangerous because a user invoking an apparently limited optimization skill could unknowingly grant it control over live trading operations and sensitive secrets.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script solicits Binance API credentials and Telegram secrets, then persists them locally, even though the skill is described as a tuning optimizer rather than an onboarding or secret-management component. In context, this is especially risky because exchange credentials can enable unauthorized trading or fund movement if over-scoped, and the mismatch between stated purpose and actual secret access increases the chance of deceptive or unsafe deployment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README normalizes an agent-driven workflow that reads performance data, modifies executor.py, validates it, and restarts the trading service automatically every 6 hours, but it does not prominently warn about the operational and security risks of autonomous code modification. In this context, automated edits to executable trading logic materially increase the chance of unsafe changes, unexpected behavior, or abuse if upstream inputs or the optimizer are compromised.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 67)May include surrounding context.

tail -f /workspace/logs/auto_optimize.log tail -f /workspace/logs/wesley_optimizations.log ls /workspace/skills/crypto-executor/executor_backup_*.py sudo systemctl status crypto-executor

text

## Fichiers

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 327)May include surrounding context.

tail -f /workspace/logs/auto_optimize.log tail -f /workspace/logs/wesley_optimizations.log ls /workspace/skills/crypto-executor/executor_backup_*.py sudo systemctl status crypto-executor

text

## Fichiers

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares significant capabilities such as shell execution and file modification but does not expose a strict tool scope like permissions or allowed-tools. This increases the risk of overbroad execution because an agent may invoke powerful operations beyond what reviewers expect from the manifest alone.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
89% confidence
Finding

The skill explicitly requires sudo to restart a service, giving it privileged process-control capability. In the context of a skill that also modifies files and downloads code, elevated restart privileges materially increase the blast radius of any compromise or bad update.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
backup, validates Python syntax, and rolls back automatically on error.
    privilege_requirements:
      uses_sudo: true
      reason: "sudo systemctl restart crypto-executor — required to restart the trading bot service"
      uses_crontab: true
      cron_schedule: "0 */6 * * *"
      cron_purpose: "Trigger Wesley optimization cycle every 6 hours"

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The skill includes outbound communication to the Telegram API, which creates an external transmission channel from a privileged automation context. Even if intended for notifications, such channels can leak operational details, errors, file paths, or secrets if message content is not tightly controlled.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
endpoints_allowed:
        - "https://raw.githubusercontent.com/georges91560/crypto-executor/main/executor.py"
        - "https://raw.githubusercontent.com/georges91560/crypto-sniper-oracle/main/crypto_oracle.py"
        - "https://api.telegram.org/bot*"
      requires_credentials: false
      uses_websocket: false
    security_level: "L2 - System Modification (modifies executor.py + restarts service)"

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The user-facing skill content is written in French ('Ce skill permet...') and continues throughout the document without indicating that another language is available. The policy requires flagging locale or language constraints when a skill effectively forces a specific language without user opt-in or a documented regional justification.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

/workspace/data/bot_config.env

Permissions automatiquement appliquées

chmod 600 /workspace/data/bot_config.env

→ Lecture réservée à l'utilisateur courant uniquement

→ Jamais visible dans systemctl status ou ps aux

text

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
88% confidence
Finding

Documenting sudo systemctl restart as part of routine operation normalizes privileged service control inside the skill workflow. Because the skill changes executable behavior by editing executor.py, this privilege can immediately activate unsafe or malicious code after modification.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

md
| Action | Pourquoi |
|---|---|
| `sudo systemctl restart crypto-executor` | Redémarrer le bot après optimisation |
| `sudo systemctl stop/start crypto-executor` | Contrôle du service au setup |
| `pkill -f executor.py` | Fallback si systemd indisponible |
| `crontab -e` | Installer le job récurrent (fallback system cron) |

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
88% confidence
Finding

The setup documentation includes sudo stop/start control, further confirming that the skill can manage service lifecycle with elevated privileges. In combination with remote downloads and parameter edits, this creates a straightforward path from file change to privileged execution under persistence.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md
| Action | Pourquoi |
|---|---|
| `sudo systemctl restart crypto-executor` | Redémarrer le bot après optimisation |
| `sudo systemctl stop/start crypto-executor` | Contrôle du service au setup |
| `pkill -f executor.py` | Fallback si systemd indisponible |
| `crontab -e` | Installer le job récurrent (fallback system cron) |

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

Installing a cron job creates persistence, allowing the skill to continue executing periodically without a fresh user action. In a skill that edits executable code, handles credentials, and controls process restarts, persistence substantially increases the risk of recurring unauthorized changes or repeated execution after compromise.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

md
| `sudo systemctl restart crypto-executor` | Redémarrer le bot après optimisation |
| `sudo systemctl stop/start crypto-executor` | Contrôle du service au setup |
| `pkill -f executor.py` | Fallback si systemd indisponible |
| `crontab -e` | Installer le job récurrent (fallback system cron) |

---

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.

bash
openclaw cron remove --name crypto-executor-optimizer
# OU
crontab -e  # supprimer la ligne crypto-executor-optimizer

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script transmits optimization status and the free-form REASON field to Telegram, an external third-party service unrelated to the core file-edit/validation task. In a trading optimizer context, those messages can leak operational details, strategy rationale, failure states, and potentially sensitive business information outside the local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script consumes Telegram credentials from environment variables and uses them for outbound requests without clear disclosure in the skill description or code comments about external data transfer. Accessing secrets to send data off-host increases exposure and can surprise operators who expect a local optimizer only.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

Hardcoding use of the Telegram API domain establishes an explicit external egress dependency in a script whose primary purpose is local file modification and process control. In this context, that external communication path is more dangerous because the optimizer handles strategy-related inputs and state.

Content

Scanner excerpt · apply_optimization.sh (reported line 195)May include surrounding context.

sh
# Telegram alert
    if [ -n "$TELEGRAM_BOT_TOKEN" ] && [ -n "$TELEGRAM_CHAT_ID" ]; then
        MSG="⚠️ Wesley Optimizer: syntax error in generated code. Original restored.%0AReason: $REASON"
        curl -s -X POST "https://api.telegram.org/bot$TELEGRAM_BOT_TOKEN/sendMessage" \
            -d "chat_id=$TELEGRAM_CHAT_ID&text=$MSG" > /dev/null
    fi
    exit 1

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

Hardcoding use of the Telegram API domain establishes an explicit external egress dependency in a script whose primary purpose is local file modification and process control. In this context, that external communication path is more dangerous because the optimizer handles strategy-related inputs and state.

Content

Scanner excerpt · apply_optimization.sh (reported line 195)May include surrounding context.

sh
# Telegram alert
    if [ -n "$TELEGRAM_BOT_TOKEN" ] && [ -n "$TELEGRAM_CHAT_ID" ]; then
        MSG="⚠️ Wesley Optimizer: syntax error in generated code. Original restored.%0AReason: $REASON"
        curl -s -X POST "https://api.telegram.org/bot$TELEGRAM_BOT_TOKEN/sendMessage" \
            -d "chat_id=$TELEGRAM_CHAT_ID&text=$MSG" > /dev/null
    fi
    exit 1

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code restarts the crypto-executor service via systemd and, on fallback, kills matching executor.py processes before launching a new one. Although actions are logged, there is no confirmation prompt or explicit safety warning near the restart logic, and these operations can disrupt a running trading bot and alter system state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.