Security audit
Security checks for vulnerabilities and agentic risk
This Freqtrade deployment skill is purpose-aligned, but it uses unsafe installation steps and defaults that can expose real funds and a trading control WebUI.
Treat this as a Review install. Do not run the remote bash installer as written. Use a pinned, inspectable Freqtrade release in an isolated environment, keep dry_run enabled until testing is complete, bind WebUI/API to localhost unless explicitly secured, replace all placeholder secrets, restrict exchange API keys to trading-only with withdrawals disabled, and avoid exposing most of the account balance to the bot.
README.md:8Mutable Remote Shell Script Is Downloaded and Executed Directly
scripts/install.sh:27Unpinned Upstream Source Is Installed into the System Python Environment
scripts/install.sh:92Trading Control API Is Exposed on All Interfaces with Predictable Default Secrets
scripts/install.sh:47Generated Configuration Enables High-Exposure Live Trading by Default
The README instructs users to execute a remote script directly with bash <(curl ...), which runs downloaded code immediately without integrity verification, pinning, or review. If the remote source, network path, or referenced branch is compromised, users could execute arbitrary code on their system during installation.
The README instructs users to start the trading bot directly with freqtrade trade --config user_data/config.json without warning that this may place real trades using live exchange credentials. In the context of an automated trading skill, this omission is especially dangerous because inexperienced users may expose real funds to buggy strategies, misconfiguration, or market losses immediately.
The skill is presented as a simple one-click deployment guide, but it instructs users to install and run a live trading bot and to configure exchange credentials without clearly disclosing the operational and exposure risks. In a financial trading context, understating that the result can execute real trades or expose management interfaces materially increases the chance of unsafe deployment and financial loss.
The installer writes a configuration that is immediately set for real-money operation by default, including "dry_run": false, "initial_state": "running", and "force_entry_enable": true. In a one-click deployment context, this is dangerous because a user may move from setup directly into live trading with real exchange credentials and no deliberate safety gate or confirmation step.
The generated config enables live trading behavior without an explicit warning that the bot will trade with real money once credentials are added and the service is started. Given the skill's stated purpose of one-click deployment for a trading bot, the lack of a prominent safety warning materially increases the risk of accidental financial loss by inexperienced users.
The README tells users to place API keys into user_data/config.json without any guidance on secret handling, file permissions, or avoiding accidental disclosure. In a trading-bot context, exposed exchange API credentials can enable unauthorized trading activity and, depending on exchange permissions, withdrawal or account manipulation.
The skill tells users to execute a remote shell script directly via curl piped into bash, which gives arbitrary code from a mutable remote source immediate execution on the host. If the upstream source, transport path, or referenced branch is compromised, the user can suffer full system compromise during installation.
The skill instructs users to place exchange API keys and secrets into a local config file but provides no guidance on secure storage, file permissions, least-privilege API scopes, or avoiding accidental disclosure. In a trading-bot context, leaked credentials can enable unauthorized trading, fund loss, or account abuse.
The example configuration enables the API/WebUI server on 0.0.0.0, exposing it on all network interfaces, but the documentation does not warn that this makes the trading control plane remotely reachable. In the context of a trading bot with functions like viewing balances, modifying configuration, and manual position control, unintended exposure can allow unauthorized access if the port is reachable and credentials are weak, reused, or intercepted.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
freqtrade trade --config user_data/config.json --strategy <策略名>
# 后台运行
nohup freqtrade trade --config user_data/config.json --strategy <策略名> &
# 查看日志
tail -f logs/freqtrade.log
The guide documents freqtrade forceexit <trade_id> without warning that it immediately closes positions and may realize losses, trigger fees, or disrupt strategy execution. In a live trading context, a user may invoke it casually or via copied commands without understanding that the action is operationally destructive and financially irreversible.
The script enables the API server by default and binds it to 0.0.0.0, exposing the WebUI/API on all network interfaces. This is especially risky because the generated config also uses predictable default credentials and placeholder secrets (e.g. "freqtrade"/"changeme"), creating a credible path to unauthorized access if the service is reachable.
The visible description and headings are presented in Chinese, which effectively forces a specific language for users without stating that the skill is region- or language-specific. Under the policy, language constraints should either offer user choice or be clearly documented and justified.
The entire skill document is written in Chinese and does not indicate that other languages are available or that Chinese is a deliberate, region-specific requirement. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy issue.
The script's comments and user-visible output force a specific language locale for usage and operational guidance. There is no opt-in, fallback language, or documented justification that this skill is intended only for Chinese-speaking users or a China-specific environment.