T09 · Insecure Skill Coding Practices
Error
- Location
scripts/outer_ratio_monitor.py:61- Finding
Incorrect Outer-to-Inner Volume Ratio Produces Misleading Financial Alerts
- Content
View full analysis
0 else 0 ``` The documented calculation in `SKILL.md:329` and `references/outer_ratio_guide.md:18-21` is: ```text Outer-to-inner ratio = outer volume / inner volume ``` ### Technical Analysis The implementation calculates the outer volume as a proportion of total classified volume: ```text outer / (outer + inner) ``` This is not the documented outer-to-inner ratio: ```text outer / inner ``` For nonnegative market-volume values, the implemented result cannot exceed `1.0`. However, `detect_alerts()` treats a result of at least `1.25` as a strong buy-side signal: ```python if data["outer_ratio"] >= ALERT_THRESHOLDS["outer_ratio_strong"]: alerts.append(f"🟢 主力建仓 外内比{data['outer_ratio']:.2f}") elif data["outer_ratio"] <= ALERT_THRESHOLDS["outer_ratio_danger"]: alerts.append(f"🔴 主力出逃 外内比{data['outer_ratio']:.2f}") ``` Consequently, the configured strong threshold is mathematically unreachable. The danger threshold is also applied to a different statistic than the documentation describes. For example, equal outer and inner volumes produce `0.5` in the implementation, causing a danger alert, whereas the documented ratio would be `1.0`, representing balanced volumes. This is a data-integrity vulnerability in a financial monitoring tool. It does not grant an attacker operating-system privileges, but it can corrupt the integrity of the tool's decision-support output. ### Attack Path 1. Tencent's market endpoint returns ordinary outer and inner volume values. 2. The monitor parses those values without tampering. 3. The monit ...[truncated 1145 chars]- Remediation
View remediation
0: outer_ratio = round(outer / inner, 4) elif outer > 0: outer_ratio = float("inf") else: outer_ratio = None ``` 2. Define explicit behavior for zero inner volume rather than silently returning zero. 3. Prevent `None` or infinite values from being formatted or compared without validation. 4. Add unit tests covering: - Equal outer and inner volumes, which should produce `1.0`. - A ratio exactly at `0.50`. - A ratio exactly at `1.25`. - Zero inner volume with nonzero outer volume. - Both values equal to zero. 5. Confirm that Tencent API fields 7 and 8 have the meanings and units assumed by the implementation. 6. Add schema and range validation for all upstream numeric fields before generating alerts. 7. Review existing stored history because previously recorded values use the incorrect formula and are incompatible with corrected values. ]]>