aicoin-freqtrade
Audited by Socket on Mar 2, 2026
1 alert found:
Obfuscated FileThe artifact is a control/interface for a Freqtrade trading bot that necessarily handles credentials and issues networked control commands. It is not demonstrably malicious from the provided materials, but it exposes significant security risks: credential exposure via environment variables, arbitrary destination (FREQTRADE_URL) enabling exfiltration, and high-impact operations that can cause financial loss if invoked by an attacker or unchecked agent. The absence of the actual script code prevents full verification of safe handling (TLS, logging, dynamic execution). Treat this package as high-risk for automated or unreviewed use: require manual code review of scripts/ft.mjs, replace raw credentials with scoped tokens, enforce host validation and TLS, and require explicit operator authorization for state-changing actions.