OpenMM Portfolio

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:12 AM UTC
• Version: 0.1.1

Overview

This skill is mostly coherent, but it asks users to give an unpinned third-party command-line tool access to exchange account credentials without enough scoping or safety guidance.

Review this before installing. Use separate read-only exchange API keys, disable trading and withdrawal permissions, avoid placing secrets directly in shell history, and consider whether you trust the current @3rd-eye-labs/openmm package release before exposing account credentials to it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party Package Exposes Exchange Credentials to Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–16
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

Complete Code Snippet

yaml

install:
  - kind: node
    package: "@3rd-eye-labs/openmm"
    bins: [openmm]

The package is installed without an exact version or integrity hash. The resulting openmm executable operates in an environment containing high-value exchange credentials documented elsewhere in SKILL.md, including API keys, secrets, a UID, and a passphrase.

Technical Analysis

The dependency declaration resolves a mutable version of @3rd-eye-labs/openmm. Because the project contains neither the package source nor a lockfile or integrity constraint, the installed implementation cannot be verified from the audited artifact.

An attacker who compromises the package publisher account, registry distribution path, or a subsequently selected package release could introduce malicious installation or runtime behavior. npm lifecycle scripts may execute during installation, while the installed CLI may access inherited environment variables when invoked. This creates a supply-chain trust boundary around credentials used for MEXC, Gate.io, Bitget, and Kraken.

The audit found no evidence that the package is currently malicious. The vulnerability is the absence of reproducible, integrity-verified dependency resolution combined with the dependency's access to sensitive exchange credentials.

Attack Path

1. An attacker compromises the package publisher, registry account, or package distribution process.
2. The attacker publishes a malicious release under the legitimate package name.
3. A new Skill installation resolves the unpinned dependency to that release.
4. Malicious code executes through an installation lifecycle hook or when an agent invokes the openmm binary.
5. The code reads exchange API keys, secrets, UID, or passphrase values from inherited environment variables.
6. The attacker exfilt ...[truncated 845 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @3rd-eye-labs/openmm to a reviewed, exact version rather than using mutable dependency resolution.
2. Enforce package integrity with a committed lockfile and verified registry integrity hashes.
3. Audit or vendor the exact package source, including npm lifecycle scripts and transitive dependencies.
4. Disable installation scripts where operationally feasible, such as with npm install --ignore-scripts.
5. Install and execute the CLI in a sandbox with restricted filesystem, network, and process permissions.
6. Expose credentials only to the specific process that needs them rather than broadly exporting them into an agent environment.
7. Use separate, read-only, least-privilege API keys for portfolio queries.
8. Disable trading, withdrawal, transfer, and account-management permissions unless explicitly required.
9. Apply exchange-supported IP allowlists and rotate credentials after any suspected dependency compromise.
10. Add automated dependency provenance, vulnerability, and unexpected-release monitoring.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill asks users to configure exchange API credentials and then use them for balance and open-order queries, but it does not warn that these commands transmit authenticated account data to third-party exchange APIs and may expose sensitive financial metadata. Even if the commands are read-oriented, authenticated requests can reveal holdings, trading activity, and account identifiers, which is privacy- and security-relevant in a portfolio-management context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.