T09 · Insecure Skill Coding Practices
- Location
scripts/trade.py:29- Finding
Unauthenticated Plaintext Transport Enables Market-Data and Trading-Signal Manipulation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/trade.py, lines 29 and 50
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: HighVulnerable Code
Real-time market data is requested over plaintext HTTP:
python url = f"http://push2.eastmoney.com/api/qt/stock/get"Historical market data is also requested over plaintext HTTP:
python url = "http://push2his.eastmoney.com/api/qt/stock/kline/get"Technical Analysis
The application retrieves both current quotes and historical candles through unencrypted and unauthenticated HTTP connections. HTTP provides no server authentication, confidentiality, or response-integrity protection.
An on-path attacker, malicious network operator, compromised proxy, or hostile access point can intercept these requests and return syntactically valid but falsified JSON. The application parses the responses without independently verifying their origin or comparing them with another trusted source. The resulting price, volume, and candle values flow directly into BOLL, MACD, and KDJ calculations and are then used to generate trading signals and backtest results.
Request timeouts limit availability problems but do not protect authenticity or integrity.
Attack Path
- A user runs the skill while connected through a network controlled or observable by an attacker.
- The script sends a plaintext HTTP request to an East Money quote or history endpoint.
- The attacker intercepts the request and supplies a forged but structurally valid JSON response.
- The script accepts attacker-selected prices, volumes, or historical candles.
generate_signals()calculates technical indicators from the manipulated input.- The skill presents fabricated buy or sell signals, stop-loss outcomes, or misleading backtest metrics.
- A user may rely on that output when making financial decisions.
Impact Assessment
The attacker does not obt ...[truncated 672 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace both plaintext endpoints with official HTTPS endpoints.
- Keep TLS certificate verification enabled and fail closed when certificate validation fails.
- Do not implement insecure fallbacks from HTTPS to HTTP.
- Validate each response before use, including:
- Expected JSON structure and required fields
- Requested symbol identity
- Timestamp freshness and chronological ordering
- Numeric types and plausible price and volume ranges
- Candle consistency, such as low being no greater than high
- Cross-check financially consequential prices or signals against an independent trusted data source.
- Reject malformed, stale, incomplete, or inconsistent data instead of continuing calculations.
- Log data-source and validation failures without exposing sensitive environment information.
- Preserve the simulation-only boundary. Do not connect generated signals to real order execution without authenticated data feeds, stronger integrity checks, explicit user confirmation, and additional risk controls.