T08 · Insecure Dependencies
Error
- Location
SKILL.md:261- Finding
Unpinned Third-Party Installer Execution Creates a Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Trading Signal Analysis
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a legitimate hosted trading-analysis integration, but it needs review because it stores generated financial artifacts in the cloud by default and documents unpinned installer commands.
Before installing, decide whether your OHLCV data, symbols, strategy settings, backtest results, charts, and trade logs can be sent to AgentPMT and retained briefly in cloud storage. For sensitive research, explicitly set `store_charts` and `store_trade_log` to false or minimize `expiration_days`; avoid putting secrets in prompts; and prefer a pinned, verified install path instead of the floating `npx` examples.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
schema.md:665- Finding
Cloud Persistence of Financial Analysis Artifacts Is Enabled by Default
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (12)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill is built around remote MCP/REST calls but does not prominently disclose, near the top-level metadata or usage guidance, that user-supplied OHLCV datasets are sent to external services for processing. While OHLCV data is often non-secret, in this context it may include proprietary strategy research datasets, making undisclosed transmission materially risky.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill states that charts and trade logs are stored in cloud storage with signed download URLs, but it does not clearly warn users that submitted market data and derived outputs may be retained externally. This creates a transparency and data-governance issue, especially if users upload proprietary trading datasets or sensitive research outputs.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 86% confidence
- Finding
The skill instructs users to install or update dependencies via
npx skillswithout pinning an exact package version or commit. That creates a supply-chain risk: a compromised or unexpectedly changed upstream package could alter the installed skill behavior or setup path at execution time.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 86% confidence
- Finding
Using
npx skillswithout version pinning allows the fetched installer or helper package to drift over time. In a skill ecosystem, that can expose users to malicious package substitution, typosquatting, or silent behavior changes during installation.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 86% confidence
- Finding
The install command relies on an unpinned
npxpackage resolution path, which can retrieve whatever version is current at the time of use. This weakens reproducibility and opens a supply-chain avenue if the package or dependency tree is compromised.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 86% confidence
- Finding
An unpinned
npx skillsinvocation means the skill's setup path depends on mutable external package state. Attackers who gain control of the package, its dependencies, or a confusingly similar package name could cause arbitrary code or altered setup instructions to be delivered.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 86% confidence
- Finding
Because
npxresolves packages dynamically, leaving the package version unspecified creates an avoidable supply-chain exposure. This is especially relevant in an agent skill distribution context where users may blindly follow setup instructions.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 86% confidence
- Finding
The referenced setup skill installation uses a floating
npx skillscommand, so the user may retrieve a different package version than expected. That undermines trust in the setup chain and can enable package compromise or malicious update scenarios.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 86% confidence
- Finding
This command inherits the same unpinned package resolution risk as the other
npx skillsreferences. If the upstream package changes or is compromised, users may execute attacker-controlled install logic while attempting to set up related skills.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`) - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`) - Marketplace product: https://www.agentpmt.com/marketplace/trading-signal-analysis - AgentPMT main MCP server: https://api.agentpmt.com/mcp/ - AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`) - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`) - Marketplace product: https://www.agentpmt.com/marketplace/trading-signal-analysis - AgentPMT main MCP server: https://api.agentpmt.com/mcp/ - AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The schema advertises
store_charts,store_trade_log, andexpiration_daysfeatures that persist generated artifacts in cloud storage, but it does not clearly warn users that uploaded OHLCV datasets, symbol labels, or derived trade logs may be retained remotely and remain downloadable for a period of time. In an agent setting, this can cause unintentional disclosure or retention of sensitive or proprietary trading data because callers may assume analysis is transient unless storage behavior is explicitly disclosed.- Content
Static analysis
No suspicious patterns detected.