T09 · Insecure Skill Coding Practices
Error
- Location
scripts/realtime-agent.js:428- Finding
Unauthenticated WebSocket Signals Can Trigger Real Financial Transactions
- Content
View full analysis
{ openedAt = Date.now(); state.reconnectAttempts = 0; console.log(`[info] websocket connected: ${endpoint}`); socket.send( JSON.stringify({ type: "subscribe", channel: config.channel }) ); }); socket.on("message", (raw) => { let envelope; try { envelope = JSON.parse(String(raw)); } catch (_err) { return; } const signals = signalItemsFromEnvelope(envelope); for (const signal of signals) { const signalAgent = String(signal.agent_name || "").trim(); const side = normalizeSignalSide(signal.side); const confidence = toNumber(signal.confidence, 0); const ts = Math.floor(toNumber(signal.ts, Math.floor(Date.now() / 1000))); if (!side) { continue; } if (config.agentNameFilter && signalAgent !== config.agentNameFilter) { continue; } if (confidence < config.minConfidence) { continue; } enqueueSignalExecution(signal, side, confidence, ts, config, state, userMargin); } }); ``` The execution branch places a real order unless dry-run mode was explicitly enabled: ```js if (config.dryRun) { console.log(`[dry-run] node scripts/order-execute.js ${orderArgs.join(" ")}`); } else { const result = await executeOrder(orderArgs); if (result.stdout.trim()) { process.stdout.write(result.stdout); } if (result.stderr.trim()) { process.stderr.write(result.stderr); } } ...[truncated 4071 chars]- Remediation
View remediation