Nautilus Trader

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:27 AM UTC
• Version: 0.1.0

Overview

This skill is coherent with live trading, but its examples and patch can perform real Hyperliquid mainnet actions with wallet credentials and too little user confirmation.

Review this carefully before installing. Use only testnet or paper trading until you have added explicit mainnet flags, dry-run mode, wallet and vault confirmation, order-size and leverage limits, and dependency pinning. Do not run the included live_trading.py or set_leverage.py with a funded wallet unless you intend real mainnet trades and leverage changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: references/hyperliquid_patch.py:116

Finding

Incomplete exchange response handling can desynchronize local and live trading state

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/live_trading.py:51

Finding

Example scripts execute financially consequential mainnet actions without explicit confirmation

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/requirements.txt:2

Finding

Wallet-sensitive trading dependencies are not reproducibly pinned

Content

View full analysis

=1.222.0,<1.223.0 # Hyperliquid SDK hyperliquid-python-sdk>=0.10.0 eth-account>=0.11.0 # Environment python-dotenv>=1.0.0 ``` From `SKILL.md`: ```bash # NautilusTrader (backtesting + live trading framework) pip install nautilus_trader # Hyperliquid SDK (for live trading patch) pip install hyperliquid-python-sdk eth-account python-dotenv # Data handling pip install pandas numpy ``` From `references/README.md`: ```bash pip install nautilus_trader hyperliquid-python-sdk eth-account python-dotenv ``` ### Technical Analysis The Hyperliquid SDK and `eth-account` receive or process a wallet private key and participate in signing live trading actions. `python-dotenv` loads that key into the process environment, while NautilusTrader controls live order execution. Despite their security-sensitive role: - Most dependencies have no upper version bound. - None are pinned to an exact audited version. - No package hashes are provided. - No lockfile or reproducible environment is included. - The primary documentation recommends entirely unpinned installation commands. A future release can therefore be installed automatically without review. This creates both compatibility and supply-chain risk. Any dependency executes with the same operating-system privileges as the Python process and may read environment variables, files available to the user, or modify the behavior of signed order requests. No evidence was found that the currently named packages are typosquatted or malicious. The vulnerability is the inability to reproduce and constrain the reviewed dependency set. ### Attack Path 1. An attacker compromi ...[truncated 1334 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (655)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 392)May include surrounding context.

text

your_trading_project/
├── .env                        # Credentials (gitignored)
├── hyperliquid_patch.py        # SDK patch for live trading
├── heiken_ashi.py              # Heiken Ashi indicator
├── my_strategy.py              # Strategy implementation

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/hyperliquid.md (reported line 638)May include surrounding context.

text

your_trading_project/
├── .env                        # Credentials (gitignored)
├── hyperliquid_patch.py        # SDK patch for live trading
├── heiken_ashi.py              # Heiken Ashi indicator
├── my_strategy.py              # Strategy implementation

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/api.md (reported line 13)May include surrounding context.

md

# Nautilus_Trader - Api

**Pages:** 17

---

## Serialization

**URL:** https://nautilustrader.io/docs/latest/api_reference/serialization

**Contents:**
- Serialization
  - register_serializable_type(type cls: type, to_dict: Callable[[Any], dict[str, Any]], from_dict: Callable[[dict[str, Any]], Any]) → void​
  - class MsgSpecSerializer​
    - deserialize(self, bytes obj_bytes)​
    - serialize(self, obj) → bytes​
    - timestamps_as_iso8601​
    - timestamps_as_str​
  - class Serializer​
    - WARNING​
    - deserialize(self, bytes obj_bytes)​

The serialization subpackage groups all serialization components and serializer implementations.

Base classes are defined which can allow for other serialization implementations beside the built-in specification serializers.

Register the given type with the global serialization type maps.

The type will also be registered as an exter

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/api.md (reported line 2586)May include surrounding context.

md

WebSocket clients handle real-time streaming data and require careful management of connection state, authentication, subscriptions, and reconnection logic.

WebSocket clients typically don't need the inner/outer pattern since they're not frequently cloned. Use a single struct with clear state management.

Handle authentication separately from subscriptions.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file describes deleting data within a specified time range across the catalog and for specific data classes/instruments, but it does not include any caution that this is destructive or potentially irreversible. For markdown files, omission of warnings about destructive effects on user data is a reportable missing-warning issue.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/concepts.md (reported line 13)May include surrounding context.

md

# Nautilus_Trader - Concepts

**Pages:** 19

---

## Strategies

**URL:** https://nautilustrader.io/docs/latest/concepts/strategies

**Contents:**
- Strategies
- Strategy implementation​
  - Handlers​
    - Stateful actions​
    - Data handling​
    - Order management​
    - Position management​
    - Generic event handling​
    - Handler example​
  - Clock and timers​

The heart of the NautilusTrader user experience is in writing and working with trading strategies. Defining a strategy involves inheriting the Strategy class and implementing the methods required by the strategy's logic.

Relationship with actors: The Strategy class inherits from Actor, which means strategies have access to all actor functionality plus order management capabilities.

We reco

Ae3

High

• Category: analysis-evasion
• Confidence: 90% confidence

Finding

Text artifact contains embedded NUL bytes

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/data.md (reported line 13)May include surrounding context.

md

# Nautilus_Trader - Data

**Pages:** 12

---

## OKX

**URL:** https://nautilustrader.io/docs/latest/integrations/okx

**Contents:**
- OKX
- Overview​
- Examples​
  - Product support​
- Symbology​
  - Symbol format by instrument type​
    - SPOT​
    - SWAP (Perpetual Futures)​
    - FUTURES (Dated Futures)​
    - OPTIONS​

Founded in 2017, OKX is a leading cryptocurrency exchange offering spot, perpetual swap, futures, and options trading. This integration supports live market data ingest and order execution on OKX.

This adapter is implemented in Rust, with optional Python bindings for ease of use in Python-based workflows. It does not require external OKX client libraries—the core components are compiled as a static

Ae3

High

• Category: analysis-evasion
• Confidence: 96% confidence

Finding

The file contains an embedded NUL byte in rendered documentation text ('Binary options\0'). Hidden control characters are dangerous in agent-consumed artifacts because parsers, tokenizers, scanners, or downstream tools may truncate, mis-parse, or treat surrounding content inconsistently, creating opportunities for content smuggling or analysis evasion. In a skill/reference file, that makes the artifact less trustworthy and can interfere with security tooling.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 95% confidence

Finding

This line combines a hidden formatting character with an embedded NUL byte in the phrase 'Binary options\0', making it more than a mere typography artifact. Control characters in agent-readable docs can cause parser differentials, truncation, or scanner bypasses, which is a meaningful content-integrity risk even if likely introduced accidentally.

Content

Scanner excerpt · references/data.md (reported line 843)May include surrounding context.

md

- Polymarket
- Installation​
- Examples​
- Binary options​
- Polymarket documentation​
- Overview​
- USDC.e (PoS)​

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The live trading example is wired for is_testnet=False, loads a private key, builds a trading node, and calls node.run() without a conspicuous warning that this starts real mainnet trading. In this skill context, that is especially dangerous because the code is presented as a complete ready-to-run example and includes an auto-applied execution patch, making accidental deployment more likely.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

This file reads sensitive credentials from environment variables via os.getenv("HYPERLIQUID_PK") and uses them to authenticate a live trading client, but the capability is not declared. In an agent skill context, undeclared environment access is dangerous because it can silently consume secrets available to the runtime and enable real-money actions without explicit permission boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This example places a real IOC market buy order automatically on the first bar in a live-trading script, with no interactive confirmation, feature flag, dry-run safeguard, or prominent warning to the user. In the context of an agent skill meant to help users build and deploy trading strategies, that makes accidental real-money execution materially more likely, especially if a user copies the example verbatim.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/other.md (reported line 13)May include surrounding context.

md

# Nautilus_Trader - Other

**Pages:** 15

---

## Release Notes Guide

**URL:** https://nautilustrader.io/docs/latest/developer_guide/releases

**Contents:**
- Release Notes Guide
- Sections​
  - Enhancements​
  - Breaking Changes​
  - Security​
  - Fixes​
  - Internal Improvements​
  - Documentation Updates​
  - Deprecations​
- Attribution​

This guide documents the standards for writing release notes in RELEASES.md.

Use the following sections in this order:

Omit sections that have no items for a given release.

New features and user-visible improvements.

Changes that may break existing code.

Security hardening and fixes that prevent crashes, undefined behavior, or data corruption. Includes significant hardening improvements elevated from Internal Improveme

Credential Access

High

• Category: Privilege Escalation
• Confidence: 72% confidence

Finding

The documentation instructs users to provide database connection configuration through command-line arguments or a .env file in the project/current directory. In agent or shared workspace contexts, encouraging local .env-based secret storage without caution can expose credentials through accidental commits, workspace leakage, or tool access to working-directory secrets.

Content

Scanner excerpt · references/other.md (reported line 1022)May include surrounding context.

md

You can run nautilus --help to view the CLI structure and available command groups:

These commands handle bootstrapping the PostgreSQL database. To use them, you need to provide the correct connection configuration, either through command-line arguments or a .env file located in the root directory or the current working directory.

List of commands are:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/set_leverage.py (reported line 23)May include surrounding context.

python

def main():
    pk = os.getenv("HYPERLIQUID_PK")
    if not pk:
        print("Set HYPERLIQUID_PK in environment or .env")
        return

    if not pk.startswith("0x"):

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 13)May include surrounding context.

md

**Contents:**
- Trading
  - class Controller​
    - create_actor(actor: Actor, start: bool = True) → None​
    - create_actor_from_config(actor_config: ImportableActorConfig, start: bool = True) → None​
    - create_strategy(strategy: Strategy, start: bool = True) → None​

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 14)May include surrounding context.

md

**Contents:**
- Trading
  - class Controller​
    - create_actor(actor: Actor, start: bool = True) → None​
    - create_actor_from_config(actor_config: ImportableActorConfig, start: bool = True) → None​
    - create_strategy(strategy: Strategy, start: bool = True) → None​

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 15)May include surrounding context.

md

**Contents:**
- Trading
  - class Controller​
    - create_actor(actor: Actor, start: bool = True) → None​
    - create_actor_from_config(actor_config: ImportableActorConfig, start: bool = True) → None​
    - create_strategy(strategy: Strategy, start: bool = True) → None​

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 16)May include surrounding context.

md

**Contents:**
- Trading
  - class Controller​
    - create_actor(actor: Actor, start: bool = True) → None​
    - create_actor_from_config(actor_config: ImportableActorConfig, start: bool = True) → None​
    - create_strategy(strategy: Strategy, start: bool = True) → None​

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 17)May include surrounding context.

md

**Contents:**
- Trading
  - class Controller​
    - create_actor(actor: Actor, start: bool = True) → None​
    - create_actor_from_config(actor_config: ImportableActorConfig, start: bool = True) → None​
    - create_strategy(strategy: Strategy, start: bool = True) → None​

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 18)May include surrounding context.

md

**Contents:**
- Trading
  - class Controller​
    - create_actor(actor: Actor, start: bool = True) → None​
    - create_actor_from_config(actor_config: ImportableActorConfig, start: bool = True) → None​
    - create_strategy(strategy: Strategy, start: bool = True) → None​

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 19)May include surrounding context.

md

**Contents:**
- Trading
  - class Controller​
    - create_actor(actor: Actor, start: bool = True) → None​
    - create_actor_from_config(actor_config: ImportableActorConfig, start: bool = True) → None​
    - create_strategy(strategy: Strategy, start: bool = True) → None​

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 20)May include surrounding context.

md

**Contents:**
- Trading
  - class Controller​
    - create_actor(actor: Actor, start: bool = True) → None​
    - create_actor_from_config(actor_config: ImportableActorConfig, start: bool = True) → None​
    - create_strategy(strategy: Strategy, start: bool = True) → None​

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 21)May include surrounding context.

md

**Contents:**
- Trading
  - class Controller​
    - create_actor(actor: Actor, start: bool = True) → None​
    - create_actor_from_config(actor_config: ImportableActorConfig, start: bool = True) → None​
    - create_strategy(strategy: Strategy, start: bool = True) → None​

Static analysis

No suspicious patterns detected.