OpenMM Exchange Setup

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:12 AM UTC
• Version: 0.1.0

Overview

This skill is a clear OpenMM exchange setup guide, but it asks users to run unpinned third-party packages with active exchange trading credentials, so it should get human review before installation.

Review the package provenance and pin exact versions before using this skill. Use exchange API keys with no withdrawal or transfer permissions, IP allowlisting, minimum trading scope, and low-value or test accounts first. Prefer a secret manager or locked-down config outside the repository instead of a project .env file, and avoid printing full API keys in terminals or logs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:8

Finding

Unpinned Third-Party Packages Execute with Exchange Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:8-12 and SKILL.md:123-137
Vulnerability Type: Unpinned npm dependencies and unsafe supply-chain execution
Risk Level: High

Vulnerable Code

yaml

install:
  - kind: node
    package: "@3rd-eye-labs/openmm"
    bins: [openmm]

json

{
  "mcpServers": {
    "openmm": {
      "command": "npx",
      "args": ["@qbtlabs/openmm-mcp"],
      "env": {
        "MEXC_API_KEY": "your_key",
        "MEXC_SECRET": "your_secret",
        "KRAKEN_API_KEY": "your_key",
        "KRAKEN_SECRET": "your_secret"
      }
    }
  }
}

Technical Analysis

The Skill instructs the environment to install @3rd-eye-labs/openmm without an exact version. It separately invokes @qbtlabs/openmm-mcp through npx, also without an exact version. Consequently, the package versions executed may change after the Skill has been reviewed.

The MCP package is additionally launched with exchange API credentials in its environment. Code executed by that package can read all supplied environment variables. No malicious package content is present in the audited project, but the configuration creates a supply-chain trust boundary in which a compromised publisher account, malicious future release, registry compromise, or package ownership transfer could convert the dependency into a credential-stealing or unauthorized-trading payload.

The differing package scopes also increase the need to verify that both dependencies are intentional, authentic components maintained by trusted publishers.

Attack Path

1. An attacker compromises the npm publisher, package repository, release process, or another relevant supply-chain component.
2. The attacker publishes a malicious version under one of the referenced package names.
3. A user installs the unpinned OpenMM package or starts the MCP server using npx.
4. The package manager resolves and executes the a ...[truncated 1031 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin both npm dependencies to reviewed, exact versions rather than relying on the latest matching release.
2. Use a lockfile with verified integrity hashes and enforce immutable or reproducible installation behavior.
3. Avoid ad hoc npx resolution for credential-bearing services. Install a reviewed version explicitly and invoke its fixed local path.
4. Verify the ownership, source repository, release provenance, and maintenance status of both npm package scopes.
5. Review package contents, lifecycle scripts, transitive dependencies, and network behavior before providing exchange credentials.
6. Use npm provenance or signed release verification where available.
7. Run the MCP service as an isolated, unprivileged account or container with restricted filesystem and network access.
8. Supply only the credentials required for the selected exchange and avoid inheriting unrelated environment variables.
9. Use exchange API keys with no withdrawal or transfer rights, strict IP allowlisting, minimal trading permissions, and low account exposure.
10. Initially validate integrations with testnet or dedicated low-value accounts and rotate credentials after any suspected dependency compromise.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:62

Finding

Plaintext Credential Storage and Terminal Disclosure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:62-96 and SKILL.md:146-149
Vulnerability Type: Insecure handling and disclosure of sensitive credentials
Risk Level: Medium

Vulnerable Code

bash

# MEXC
export MEXC_API_KEY="your_mexc_api_key"
export MEXC_SECRET="your_mexc_secret_key"

# Gate.io
export GATEIO_API_KEY="your_gateio_api_key"
export GATEIO_SECRET="your_gateio_secret_key"

# Bitget (requires passphrase)
export BITGET_API_KEY="your_bitget_api_key"
export BITGET_SECRET="your_bitget_secret_key"
export BITGET_PASSPHRASE="your_bitget_passphrase"

# Kraken
export KRAKEN_API_KEY="your_kraken_api_key"
export KRAKEN_SECRET="your_kraken_secret_key"

env

MEXC_API_KEY=your_mexc_api_key
MEXC_SECRET=your_mexc_secret_key
GATEIO_API_KEY=your_gateio_api_key
GATEIO_SECRET=your_gateio_secret_key
BITGET_API_KEY=your_bitget_api_key
BITGET_SECRET=your_bitget_secret_key
BITGET_PASSPHRASE=your_bitget_passphrase
KRAKEN_API_KEY=your_kraken_api_key
KRAKEN_SECRET=your_kraken_secret_key

bash

echo $MEXC_API_KEY

Technical Analysis

The Skill recommends storing exchange API keys, secrets, and a passphrase in a plaintext .env file. Although it later advises adding .env to .gitignore, Git exclusion does not protect the file from other local users, compromised processes, backups, filesystem snapshots, archive operations, accidental uploads, or overly broad file permissions.

Exported environment variables can also be inherited by child processes and may be exposed through process inspection, diagnostics, crash reporting, or application logging depending on the host platform and runtime.

The troubleshooting instruction prints the complete MEXC API key to standard output. Terminal output can be captured in shell-session recordings, CI logs, remote support transcripts, screenshots, clipboard history, or centralized logging systems. An API key is less sensitive th ...[truncated 1783 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an operating-system credential store, dedicated secret manager, or MCP client secret facility instead of project-level plaintext files.
2. If a credential file is unavoidable, store it outside the repository and restrict access to the service account, such as with mode 0600 on supported systems.
3. Keep .env in .gitignore, add repository-level secret scanning, and provide only a placeholder .env.example.
4. Do not print complete API keys. Test only whether a variable is present, or display a short redacted suffix for identification.
5. Prevent secret values from entering CI logs, support transcripts, telemetry, crash reports, and shell-session recordings.
6. Launch the application with a minimal environment so unrelated child processes do not inherit exchange credentials.
7. Configure separate keys for each service and environment with minimum read and trading permissions.
8. Continue to prohibit withdrawals and transfers, enforce IP allowlisting, and use short rotation periods.
9. Revoke and rotate any credential that has appeared in terminal output, logs, version control, archives, or an improperly protected file.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md

### "Timestamp Error"
- System clock may be out of sync
- Run: `sudo ntpdate time.google.com`

### "Rate Limited"
- Reduce request frequency