T08 · Insecure Dependencies
Warning
- Location
SKILL.md:463- Finding
Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Oanda Forex Trading
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed OANDA trading integration, but it can use connected credentials to place, change, cancel, or close live-money forex trades without clear mandatory confirmation or exposure limits.
Only install this if you intentionally want an agent to access an AgentPMT-connected OANDA account. Use practice credentials unless you have separate controls for live trading, and require explicit human confirmation for every order, cancellation, modification, or close request. Treat remote schemas/instructions and unpinned setup commands cautiously, and avoid exposing credentials or payment secrets in prompts or logs.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:398- Finding
Mutable Remote Instructions Are Given Authority Over the Audited Skill
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:147- Finding
Live Financial Transactions Lack Mandatory Confirmation and Exposure Limits
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill exposes high-impact trading actions such as placing market and limit orders, modifying orders, cancelling orders, and closing trades or positions without any explicit warning that these operations can affect live accounts and cause immediate financial loss. In an agentic context, that omission increases the chance of unsafe autonomous execution, user misunderstanding, and irreversible transactions on real funds.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The description includes broad discovery terms such as 'forex trading automation', 'currency trading bot', and 'fx trading api', which can cause the skill to be selected in loosely related contexts. Because this skill can place and close live orders, accidental activation materially increases the chance of unauthorized or unintended financial actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The 'When To Use' section repeats generic trading keywords without requiring confirmation that the user wants this exact brokerage integration or wants to trade at all. In a skill with live-money capabilities, ambiguous routing is especially dangerous because an agent may escalate from informational market queries to order execution in the wrong account context.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
This skill is expressly designed to send trading requests and account queries to external AgentPMT endpoints, which means account data and order instructions leave the local trust boundary. In the context of a trading skill with automatic credentials and possible live-account access, external transmission is security-relevant because it can expose sensitive financial metadata and trigger irreversible real-money transactions.
- Content
md - What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`) - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`) - Marketplace product: https://www.agentpmt.com/marketplace/oanda-forex-trading-2 - AgentPMT main MCP server: https://api.agentpmt.com/mcp/ - AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
The REST invoke endpoint enables outbound transmission of account-related requests and trading actions to a third-party service. Although this is core functionality rather than covert exfiltration, the context makes it high impact: misuse, misrouting, or accidental invocation could send sensitive financial information externally or execute trades on a live account.
- Content
md - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`) - Marketplace product: https://www.agentpmt.com/marketplace/oanda-forex-trading-2 - AgentPMT main MCP server: https://api.agentpmt.com/mcp/ - AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The schema declares product slug
oanda-forex-trading-2while the skill metadata names the skilloanda-forex-trading. This mismatch can cause the wrong tool definition or backend integration to be invoked, which is especially risky in a trading skill because users may believe they are operating one account/product while requests are routed to another.- Content
Static analysis
No suspicious patterns detected.