binance-dca

clawhub:binance-dca

View source
A
92/100

First Seen

Feb 18, 2026

Last Scanned

Feb 22, 2026

Findings

50

Score

92/100

MEDIUM 1
LOW 49

Findings (50)

MEDIUM
Shell profile modification for persistence
L63

Detects instructions to modify shell config files for environment persistence

add to `~/.bashrc` or `~/.zshrc
FIX

Avoid modifying shell profiles (.bashrc, .zshrc, .profile) programmatically. Instruct users to add PATH entries manually, or use a version manager (nvm, pyenv) instead.

FP?

Likely FP if the match is documentation showing how to add a tool to PATH manually, especially if it only appends to PATH without modifying other settings.

LOW
Shell profile modification for persistence
L66

Detects instructions to modify shell config files for environment persistence

echo 'export BINANCE_API_KEY="your-api-key-here"' >> ~/.bashrc
FIX

Avoid modifying shell profiles (.bashrc, .zshrc, .profile) programmatically. Instruct users to add PATH entries manually, or use a version manager (nvm, pyenv) instead.

FP?

Likely FP if the match is documentation showing how to add a tool to PATH manually, especially if it only appends to PATH without modifying other settings.

LOW
Shell profile modification for persistence
L67

Detects instructions to modify shell config files for environment persistence

echo 'export BINANCE_SECRET_KEY="your-secret-key-here"' >> ~/.bashrc
FIX

Avoid modifying shell profiles (.bashrc, .zshrc, .profile) programmatically. Instruct users to add PATH entries manually, or use a version manager (nvm, pyenv) instead.

FP?

Likely FP if the match is documentation showing how to add a tool to PATH manually, especially if it only appends to PATH without modifying other settings.

LOW
Shell script file execution
L83

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L86

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L98

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L104

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L105

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L111

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L117

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L118

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L127

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L167

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L181

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L197

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L218

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L219

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L220

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L232

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L233

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L234

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L259

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L262

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L269

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L272

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L288

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L291

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L294

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L324

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L327

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L330

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L333

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L474

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L533

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L551

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L567

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L568

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L569

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L619

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L662

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L664

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L666

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L674

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L679

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L680

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L681

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L690

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L691

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L692

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L704

Detects execution of shell script files via bash/sh command or direct invocation

bash scripts/dca.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.