Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

HKUDS/Vibe-Trading

https://github.com/HKUDS/Vibe-Trading · scanned 2026-07-23 19:48 UTC (1 month, 2 weeks ago) · 10 languages

172 raw signals (39 security + 133 graph) 61st percentile · Python · medium (20-100K LoC)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month, 2 weeks ago · v6 · last Δ +6.0 (diff) · 159 actionable findings from 2 signal sources. 9 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
69.1
/100
Security checks
64
26 findings
System graph
74
100.0% cov · 133 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Score breakdown â 2026-05-17-v4 calibration-aware
Component Sub-score Weight Contribution
structure_score 60.0 0.15 9.00
security_score 58.3 0.25 14.57
testing_score 95.0 0.20 19.00
documentation_score 88.0 0.15 13.20
practices_score 75.0 0.15 11.25
code_quality 61.2 0.10 6.12
Overall 1.00 73.1
Calibrated penalty buckets (security_score): web: 1.6 · agent: 6.9 · authz: 8.4 · threat: 21.6 · journey: 3.3
Severity distribution — click a segment to filter
Active filters: severity: high × excluding tests × Reset all
Severity: Critical 0 High 24 Medium 73 Low 51 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 26 System graph 133 Crowd 0 Layer: Quality 86 Security 43 Cicd 3 Software 17 Frontend 6 Hardware 1 Dependencies 1 Api 2
Scan summary Repository scanned at 74.1/100 with 100.0% coverage. It contains 14060 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 133 findings — concentrated in quality (81), security (26), software (16). Risk profile is high: 0 critical, 12 high, 70 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 24 of 159 actionable findings. 168 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /swarm/runs/{run_id}/events.
A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /swarm/runs/{run_id}/events.
agent/api_server.py:1683
high Security checks software dependencies [BINARY] scipy: compound risk score 2194 (CVEs: 0, binary findings: 550)
Review binary security profile of scipy — consider alternatives with lower binary attack surface
high Security checks security prompt injection conf 0.82 LLM memory extraction can be prompt-injected into storing fake facts
Strict-JSON memory extraction from raw user and assistant text can be manipulated by a user message unless extracted facts are schema-validated and filtered before persistence.
agent/mcp_server.py:89
high Security checks security auth conf 0.83 Secret-like setting is echoed into a password input value
Settings screens sometimes render API keys, tokens, or passwords back into HTML/JSX password fields. That still exposes the secret to page source, browser extensions, screenshots, and DOM scraping.
frontend/src/pages/Settings.tsx:297
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: agent/src/skills/akshare/SKILL.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
agent/src/skills/akshare/SKILL.md:11 SecretsSkill file
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: agent/src/skills/ccxt/SKILL.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
agent/src/skills/ccxt/SKILL.md:11 SecretsSkill file
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: agent/src/skills/defi-yield/SKILL.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
agent/src/skills/defi-yield/SKILL.md:153 SecretsSkill file
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: agent/src/skills/mootdx/SKILL.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
agent/src/skills/mootdx/SKILL.md:11 SecretsSkill file
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: agent/src/skills/private-company-research/SKILL.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
agent/src/skills/private-company-research/SKILL.md:39 SecretsSkill file
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: agent/src/skills/social-media-intelligence/SKILL.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
agent/src/skills/social-media-intelligence/SKILL.md:459 SecretsSkill file
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: agent/src/skills/token-unlock-treasury/SKILL.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
agent/src/skills/token-unlock-treasury/SKILL.md:176 SecretsSkill file
high System graph quality Integrity conf 1.00 Blocking `time.sleep(...)` inside `async def start` — agent/src/channels/feishu.py:760
Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused — silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thre…
agent/src/channels/feishu.py:760 Sync io in asyncPerformance
high System graph api Wiring conf 0.90 Dangling fetch: GET /api/stats (wiki/main.js:127)
`wiki/main.js:127` calls `GET /api/stats` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matching: `/stats`
wiki/main.js:127 Dangling fetchFetch
high System graph security auth conf 0.75 FastAPI POST `shutdown_local_api` without auth dependency — agent/src/api/system_routes.py:328
`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
agent/src/api/system_routes.py:328 securityAuth fastapi unauth mutation
high System graph security security conf 1.00 Insecure pattern 'subprocess_shell_true' in agent/src/tools/bash_tool.py:43
Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.
agent/src/tools/bash_tool.py:43 Subprocess shell true
high System graph security Semgrep conf 0.70 subprocess shell true — agent/src/tools/bash_tool.py:45
Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. Rule: py…
agent/src/tools/bash_tool.py:45 SecurityPython
high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: PUT /settings/llm.
An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: PUT /settings/llm.
agent/api_server.py:1079
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /sessions/{session_id}.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /sessions/{session_id}.
agent/api_server.py:1357
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /swarm/presets.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /swarm/presets.
agent/api_server.py:1606
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /swarm/runs.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /swarm/runs.
agent/api_server.py:1613
high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /upload.
A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /upload.
agent/api_server.py:1530
high Security checks quality Quality conf 0.80 3 occurrences localStorage write failures are swallowed silently
localStorage quotas are small and writes can fail. Catching storage errors without a user-visible warning causes silent data loss when notes, images, or snapshots exceed quota.
3 files, 3 locations
wiki/docs/main.js:44
wiki/main.js:29
wiki/theme.js:26
high Security checks cicd CI/CD security conf 0.56 Compose service does not declare a runtime user
If the image does not define USER internally, this service may run as root.
docker-compose.yml:14 CI/CD securitycontainers
high Security checks cicd CI/CD security conf 0.62 2 occurrences Compose service lacks no-new-privileges hardening
no-new-privileges prevents processes from gaining additional privileges through setuid binaries or file capabilities.
lines 1, 14
docker-compose.yml:1, 14 (2 hits)
CI/CD securitycontainers
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/24442ceb-919f-4593-9d71-d90f26482ad7/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/24442ceb-919f-4593-9d71-d90f26482ad7/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.