T09 · Insecure Skill Coding Practices
Error
- Location
- behavioral_finance_skill.py:392
- Finding
- Fabricated Analysis Presented as Actionable Financial Guidance<![CDATA[ ## Vulnerability Details **File Location**: `behavioral_finance_skill.py:392-430`, `behavioral_finance_skill.py:440-441`, `behavioral_finance_skill.py:684-691`, `behavioral_finance_skill.py:721-723`, `behavioral_finance_skill.py:997-1015`, `behavioral_finance_skill.py:1088`, and `behavioral_finance_skill.py:1097` **Vulnerability Type**: Unvalidated synthetic data used for security-sensitive financial recommendations **Risk Level**: High ### Vulnerable Code The backtest operation returns fixed performance statistics rather than results calculated from market data: ```python backtest_results = { "strategy_type": strategy_type, "lookback_period": f"{lookback_days}天", "performance_metrics": { "total_trades": 42, "win_rate": 0.65, "avg_win": 0.048, "avg_loss": -0.022, "profit_factor": 2.83, "sharpe_ratio": 1.92, "max_drawdown": 0.098, "annualized_return": 0.36 }, ``` Pattern confidence is randomly generated and subsequently used to determine whether actionable signals should be returned: ```python confidence = np.random.uniform(0.4, 0.9) ``` Market-sentiment factors are also randomly generated: ```python sentiment_values = { "price_momentum": np.random.uniform(0.3, 0.8), "volume_anomaly": np.random.uniform(0.2, 0.7), "retail_sentiment": np.random.uniform(0.2, 0.9), "institutional_flow": np.random.uniform(0.3, 0.8), "news_sentiment": np.random.uniform(0.4, 0.9), "social_media_buzz": np.random.uniform(0.2, 0.8) } ``` Sentiment trends are selected randomly: ```python trends = ["上升", "下降", "震荡", "转折"] return np.random.choice(trends, p=[0.3, 0.3, 0.3, 0.1]) ``` Herding metrics, participant ratios, risk metrics, and reversal timing are generated without market observations: ```python return { "stock": stock_code, "sector": self.stock_sector_map.get(stock_code, "未知"), "herding_score": np.random.uniform(0.3, 0.9), "herding_type": np.ra ...[truncated 4218 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Integrate validated data sources** - Retrieve price, volume, fundamental, institutional-flow, news, and sentiment data from explicitly configured providers. - Validate instrument identifiers, timestamps, market sessions, data freshness, and observation coverage before analysis. - Reject requests when required source data is unavailable or stale. 2. **Remove random production decisions** - Eliminate `np.random` from production analysis and signal-generation paths. - If synthetic data is needed for demonstrations, require an explicit `demo_mode` flag and mark every result as synthetic. - Use a fixed random seed in tests so that test results are deterministic. 3. **Implement genuine backtesting** - Load historical observations for the requested lookback period. - Define entry, exit, slippage, transaction-cost, survivorship-bias, and corporate-action assumptions. - Calculate all performance metrics from executed simulated trades. - Return sample dates, trade records, data-source identifiers, and calculation assumptions. - Refuse to report performance when the sample size or data quality is insufficient. 4. **Add provenance to every result** - Include data-source names, retrieval timestamps, observation ranges, model versions, and calculation methods. - Clearly distinguish observed values, modeled estimates, and synthetic examples. - Prevent actionable output when provenance cannot be established. 5. **Validate recommendations** - Require minimum sample sizes and deterministic confidence calculations. - Apply schema validation and bounded numeric ranges to all user-controlled parameters. - Add explicit checks before generating position sizes or execution plans. - Keep execution disabled unless a separate, reviewed trading integration confirms the signal and risk constraints. 6. **Correct the documentation** - Remove claims of real-time data access and historical perfo ...[truncated 543 chars]