T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/allocation-calculator.py:42- Finding
Asset Allocation Calculator Produces a 110% Allocation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/allocation-calculator.py, lines 42-96
Vulnerability Type: Financial calculation integrity error
Risk Level: MediumVulnerable Code
python # Final stock ratio stock_ratio = max(20, min(90, base_stock_ratio + adjustment)) # Bond ratio bond_ratio = 100 - stock_ratio # Stock subdivisions domestic_stock_ratio = stock_ratio * 0.6 international_stock_ratio = stock_ratio * 0.4 # Bond subdivisions government_bond_ratio = bond_ratio * 0.6 corporate_bond_ratio = bond_ratio * 0.4 # Calculate amounts allocation = { 'stocks': { 'total': { 'ratio': stock_ratio, 'amount': total_assets * stock_ratio / 100 }, 'domestic': { 'ratio': domestic_stock_ratio, 'amount': total_assets * domestic_stock_ratio / 100, 'recommendation': '沪深 300ETF' }, 'international': { 'ratio': international_stock_ratio, 'amount': total_assets * international_stock_ratio / 100, 'recommendation': '标普 500ETF' } }, 'bonds': { 'total': { 'ratio': bond_ratio, 'amount': total_assets * bond_ratio / 100 }, 'government': { 'ratio': government_bond_ratio, 'amount': total_assets * government_bond_ratio / 100, 'recommendation': '国债 ETF' }, 'corporate': { 'ratio': corporate_bond_ratio, 'amount': total_assets * corporate_bond_ratio / 100, 'recommendation': '信用债基金' } }, 'cash': { 'ratio': 5, 'amount': total_assets * 0.05, 'recommendation': '货币基金' }, 'alternatives': { 'ratio': 5, 'amount': total_assets * 0.05, 'recommendation': '黄金 ETF/REITs' } }Technical Ana
...[truncated 2804 chars]
- Remediation
View remediation
Remediation Suggestions
Reserve cash and alternative allocations before calculating the bond allocation:
python cash_ratio = 5 alternatives_ratio = 5 bond_ratio = 100 - stock_ratio - cash_ratio - alternatives_ratioUse these variables consistently when calculating monetary amounts:
python cash_amount = total_assets * cash_ratio / 100 alternatives_amount = total_assets * alternatives_ratio / 100Add explicit invariant checks before returning or displaying the result:
python total_ratio = stock_ratio + bond_ratio + cash_ratio + alternatives_ratio if abs(total_ratio - 100.0) > 1e-9: raise ValueError(f"Allocation ratios must total 100%, got {total_ratio}%") total_amount = ( total_assets * stock_ratio / 100 + total_assets * bond_ratio / 100 + cash_amount + alternatives_amount ) if abs(total_amount - total_assets) > 0.01: raise ValueError("Allocation amounts exceed or fall short of total assets")Additional hardening should include:
- Validate that
total_assetsis finite and greater than zero. - Validate age against a documented realistic range.
- Add unit tests covering all risk profiles and boundary ages.
- Assert that stock subdivisions equal the total stock allocation.
- Assert that bond subdivisions equal the total bond allocation.
- Assert that all top-level ratios are nonnegative and total exactly 100%.
- Add regression tests using the examples documented in
README.mdandSKILL.md. - Prevent JSON output from being emitted when allocation invariants fail.
- Validate that