aicoin-freqtrade

Fail

Audited by Socket on Mar 2, 2026

1 alert found:

Obfuscated File
Obfuscated FileHIGH
SKILL.md

The artifact is a control/interface for a Freqtrade trading bot that necessarily handles credentials and issues networked control commands. It is not demonstrably malicious from the provided materials, but it exposes significant security risks: credential exposure via environment variables, arbitrary destination (FREQTRADE_URL) enabling exfiltration, and high-impact operations that can cause financial loss if invoked by an attacker or unchecked agent. The absence of the actual script code prevents full verification of safe handling (TLS, logging, dynamic execution). Treat this package as high-risk for automated or unreviewed use: require manual code review of scripts/ft.mjs, replace raw credentials with scoped tokens, enforce host validation and TLS, and require explicit operator authorization for state-changing actions.

Confidence: 98%
Audit Metadata
Analyzed At
Mar 2, 2026, 01:45 PM
Package URL
pkg:socket/skills-sh/bbx-com%2Faicoin-skills%2Faicoin-freqtrade%2F@f718547b0d0b44c5552f6dd1c928df0877270853