aicoin-trading

Warn

Audited by Runlayer on Mar 11, 2026

Risk Level: MEDIUM
Scan Summary
Max Score
90%
Files
9
Flagged
7
Chunks
12
Flagged Files (7)
aicoin-trading/lib/aicoin-api.mjsMEDIUM
89.6%

Risky tool definition detected

Tool: aicoin-trading/lib/aicoin-api.mjs Description: #!/usr/bin/env node // AiCoin API client with HMAC signing - shared lib import { createHmac, randomBytes } from 'node:crypto'; import { readFileSync, existsSync } from 'node:fs'; import { fileURLToPath } from 'node:url'; import { dirname, resolve } from 'node:path'; // Auto-load .env files (OpenClaw exec may not inject env vars into child processes) function loadEnv() { const candidates = [ resolve(process.cwd(), '.env'),

aicoin-trading/scripts/exchange.mjsMEDIUM
89.2%

Risky tool definition detected

Description: = to_account.toLowerCase(); const from = ALIAS[fromRaw] || fromRaw; const to = ALIAS[toRaw] || toRaw; try { return await ex.transfer(code, amount, from, to); } catch (err) { const msg = err.message || String(err); // Binance: API key lacks Universal Transfer permission if (exchange === 'binance' && (msg.includes('-1002') || msg.includes('not authorized'))) { throw new Error(`Binance 划转失败: API Key 没有万向划转(Universal Transfer)权限。请在 Binance API 管理后台开启「Permits Universal Transfer / 允许万向划转」

aicoin-trading/scripts/auto-trade.mjsMEDIUM
89.0%

Risky tool definition detected

import { cli } from '../lib/aicoin-api.mjs'; import { execFileSync } from 'node:child_process'; import { readFileSync, writeFileSync, existsSync } from 'node:fs'; import { fileURLToPath } from 'node:url'; import { dirname, resolve } from 'node:path'; const __dir = dirname(fileURLToPath(import.meta.url)); const WORKSPACE = resolve(process.env.HOME || '', '.openclaw', 'workspace'); const CONFIG_PATH = resolve(WORKSPACE, 'aicoin-trade-config.json'); const DEFAULT_CONFIG = { exchange: 'okx', symbol:

aicoin-trading/scripts/api-key-info.mjsMEDIUM
87.1%

Risky tool definition detected

Tool: aicoin-trading/scripts/api-key-info.mjs Description: #!/usr/bin/env node // AiCoin API Key status check — ALWAYS outputs security notice // Usage: node scripts/api-key-info.mjs [check] // When user asks about configuring/checking AiCoin API key, run this script.

aicoin-trading/lib/defaults.jsonMEDIUM
86.3%

Risky tool definition detected

Users can replace with their own key via env vars.", "accessKeyId": "ronJ8uI0Yj2soAfGVs5H1YALUIINbE22", "accessSecret": "CWHZcH2us1CLSE7grroR1TpS0Z1JxTwU" }

aicoin-trading/scripts/trade.mjsMEDIUM
77.2%

Risky tool definition detected

aicoin-trading/SKILL.mdLOW
59.4%

Tool passed security scan

Passed Files (2)Click to expand
aicoin-trading/scripts/register.mjsOK
42.6%

Tool passed security scan

aicoin-trading/package.jsonOK
5.2%

Tool passed security scan

Audit Metadata
Max File Score
90%
Classification
KNOWN_SERVER_KNOWN_TOOL_LIST
Files Scanned
9
Files Flagged
7
Chunks Analyzed
12
Analyzed
Mar 11, 2026, 02:54 PM
Security Audit — runlayer — aicoin-trading