T09 · Insecure Skill Coding Practices
Error
- Location
analyze_nio.py:14- Finding
Synthetic market data is presented as real-time analysis and used for financial recommendations
- Content
View full analysis
Vulnerability Details
File Location:
analyze_nio.py:14-220; supporting documentation atSKILL.md:13-16, 61-65
Vulnerability Type: Misrepresentation of randomized and hard-coded financial data
Risk Level: HighEvidence
The reported US and Hong Kong prices are generated from fixed values plus pseudorandom variation rather than retrieved from a market-data provider:
python current_price = 6.30 + random.uniform(-0.2, 0.2) change = current_price - 6.30 change_percent = (change / 6.30) * 100python current_price = 48.70 + random.uniform(-1.0, 1.0) change = current_price - 48.70 change_percent = (change / 48.70) * 100Technical indicators and price levels are also fixed or derived from fixed thresholds:
python if market_type == "us": support_levels = [6.00, 5.80, 5.50] resistance_levels = [6.50, 6.80, 7.00] ma_20 = 6.20 ma_50 = 6.00 rsi = 58 if price > ma_20 else 42 else: support_levels = [47.00, 45.50, 44.00] resistance_levels = [50.00, 52.00, 55.00] ma_20 = 48.00 ma_50 = 46.50 rsi = 62 if price > ma_20 else 45Analyst, social-media, and institutional sentiment values are hard-coded:
python return { "analyst_ratings": { "buy": 12, "hold": 8, "sell": 3, "average_target": 7.50 if random.random() > 0.5 else 7.20, "upside_potential": "19%" if random.random() > 0.5 else "15%" }, "social_sentiment": { "twitter_bullish": 65, "twitter_bearish": 25, "twitter_neutral": 10, "trending_topics": ["#NIO", "#EVstocks", "#蔚来"] }, "institutional_activity": { "net_buying": "轻度净买入", "major_buyers": ["BlackRock", "Vanguard", "Fidelity"], "options_activity": "看涨期权活跃度增加" } }These synthetic inputs directly determine financial recommendations:
python ...[truncated 3211 chars]- Remediation
View remediation
Remediation Suggestions
- Replace randomized and hard-coded market values with authenticated, documented market-data and news APIs.
- Record the provider, instrument identifier, retrieval time, exchange time, and source URL or API endpoint for every externally obtained value.
- Validate response status, schema, instrument identity, currency, trading session, and data freshness before producing analysis.
- Fail closed when authoritative data is unavailable. Do not issue buy, hold, reduce, target-price, stop-loss, or position-sizing recommendations from simulated fallback data.
- If simulation is intentionally retained for demonstrations or tests, require an explicit simulation flag and prominently mark every console and JSON report with fields such as
"simulated": trueand"not_real_time": true. - Separate demonstration fixtures from production logic so that synthetic news, analyst ratings, and institutional claims cannot enter production reports.
- Update
SKILL.mdto accurately distinguish implemented sources from planned integrations and remove unsupported real-time claims. - Add automated tests that reject reports labeled as real-time when they lack verifiable source metadata or contain simulated inputs.
- Consider removing direct financial recommendations unless the inputs are authoritative, sufficiently fresh, and accompanied by clear methodology and limitations.
- Modify
run_analysis.shto execute the analyzer only once per invocation; its current two executions can produce inconsistent randomized results in the report and log.