T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:748- Finding
Unauthenticated Webhook Signals Can Trigger Financial Trades
- Content
View full analysis
Optional[dict]: """Process an incoming trade signal from a leader.""" leader_id = signal.get("leader_id") sub = self._subscriptions.get(leader_id) if not sub or not sub.active: return None symbol = signal.get("symbol") # Check symbol whitelist if sub.allowed_symbols and symbol not in sub.allowed_symbols: return {"status": "skipped", "reason": "symbol_not_allowed"} # Check drawdown limit if sub.cumulative_pnl < 0 and abs(sub.cumulative_pnl) >= sub.max_drawdown_pct: sub.active = False return {"status": "stopped", "reason": "max_drawdown_reached"} # Check total allocation to this leader current_allocation = sum( pos.get("allocated_usd", 0) for pos in sub.positions.values() ) max_allocation_usd = self.portfolio_value * (sub.max_allocation_pct / 100) if current_allocation >= max_allocation_usd: return {"status": "skipped", "reason": "max_allocation_reached"} # Calculate position size leader_size_pct = float(signal.get("size_pct", 0)) capped_size_pct = min(leader_size_pct, sub.max_position_size_pct) position_usd = self.portfolio_value * (capped_size_pct / 100) # Ensure we do not exceed remaining allocation remaining = max_allocation_usd - current_allocation position_usd = min(position_usd, remaining) if position_usd < 10: # Minimum ...[truncated 4445 chars]- Remediation
View remediation