T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/regime_detector.py:47
- Finding
- Fail-Open Regime Detector Produces Fabricated Actionable Trading Signals## Vulnerability Details **File Location**: `scripts/regime_detector.py:47-50, 83-99` **Vulnerability Type**: Unsafe fail-open behavior and fabricated fallback data **Risk Level**: High ### Vulnerable Code ```python if len(prices) < 20: return _simulation_mode(symbol) if not HAS_NUMPY: return _simulation_mode(symbol) ``` ```python def _simulation_mode(symbol): """Fallback when numpy not available.""" return { "regime": "TRENDING", "adx": 28.5, "trend_strength": "moderate", "signal": "follow", "symbol": symbol, "timestamp": datetime.utcnow().isoformat() + "Z", "candles_analyzed": 0, "mode": "simulation" } if __name__ == "__main__": symbol = sys.argv[1] if len(sys.argv) > 1 else "BTCUSDT" result = detect_regime([], symbol) print(json.dumps(result, indent=2)) ``` ### Technical Analysis The detector converts two failure conditions—fewer than 20 market candles and an unavailable NumPy dependency—into a plausible, actionable result of `TRENDING` with a `follow` signal and a fabricated ADX value of `28.5`. It does not return an error, an `UNKNOWN` regime, or a non-actionable `hold` signal. The command-line entry point always calls `detect_regime([], symbol)` with an empty dataset. Consequently, every ordinary CLI invocation deterministically enters simulation mode rather than analyzing market data. Although the output includes `"mode": "simulation"`, its primary fields have the same structure and actionable semantics as a genuine result. This is especially dangerous because `SKILL.md` describes regime detection as ADX and trend analysis and places its output before analyst review, judgment, position sizing, and possible trade execution. No documented control requires downstream components to reject simulation-mode results. ### Attack Path 1. An operator or automation invokes: ```bash python scripts/regime_detector.py BTCUSDT ``` 2. The CLI passes an em ...[truncated 1396 chars]
- Remediation
- ## Remediation Suggestions 1. **Fail closed on missing inputs or dependencies.** Return a non-actionable result such as: ```python { "regime": "UNKNOWN", "signal": "hold", "error": "Insufficient validated market data" } ``` 2. **Exit with a nonzero status from the CLI** when valid OHLC data is unavailable. Do not silently replace production analysis with simulated values. 3. **Require actual market data as CLI input**, such as a validated JSON file or standard input containing at least the required number of candles. 4. **Place simulation behind an explicit flag**, such as `--simulate`, and ensure simulation output cannot be consumed by production execution components. 5. **Enforce downstream safeguards.** Trading judgment and execution components must reject results when: - `mode` is not `live`; - `candles_analyzed` is below the required threshold; - data provenance is absent; - data is stale or malformed; - the regime is `UNKNOWN`; or - an analysis dependency failed. 6. **Separate result schemas for production and simulation** or add an explicit `actionable: false` field that downstream code must validate. 7. **Add automated tests** confirming that empty, insufficient, malformed, stale, or nonnumeric candle data and unavailable dependencies can never produce actionable signals. 8. **Record data provenance and freshness**, including candle source, latest candle timestamp, timeframe, validation status, and analysis mode.