Security audit

Trading Signals

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a trading-analysis tool, but it can use a local email API key to send trading reports to a preset Gmail address and stores local signal state without enough user control.

Review before installing or running. Remove or replace the default alert email, do not provide Resend credentials unless you want this skill to send reports through that account, and only run monitor.js if you intend continuous polling. Check and clear .signal-state.json if you do not want local signal history retained.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill advertises code capabilities that access environment-related resources but does not declare any permissions, which undermines transparency and permission scoping. In an agent setting, undeclared access makes it harder for users and reviewers to understand what sensitive data or local configuration the skill may touch.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared behavior omits several materially important actions: sending outbound email, reading local Resend credentials from a user config directory, and persisting state locally. This mismatch is dangerous because users may invoke a market-analysis skill without realizing it can access local secrets, write files, or trigger external communications, creating privacy, credential, and unintended-action risks.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The file hard-codes an external email recipient for alerts, which creates a built-in notification/data egress path not clearly required by a static asset reference list. In a trading-signals skill, this could cause market signals, user-triggered events, or operational data to be sent to a personal mailbox without explicit user consent, creating privacy, compliance, and misuse risk.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: This file adds outbound email delivery to a skill described as generating trading signals, which is a capability expansion outside the stated purpose. Even if intended for reporting, it enables exfiltration of generated content to arbitrary recipients and increases abuse potential in a context that already handles potentially sensitive market activity or user data.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The code reads an API key from a local credentials file in the user's home directory for an external email provider, despite that behavior not being justified by the trading-analysis scope. Accessing local secrets in an unrelated skill materially raises the risk of credential misuse and unauthorized outbound communications.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: Mentioning email notifications and continuous monitoring without prominent warnings about outbound messaging and ongoing automated execution creates a consent and surprise-action problem. In practice, a user may trigger a passive-seeming analysis skill that continues running or sends external alerts, which increases the risk of unauthorized communication, resource use, and privacy exposure.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The function sends recipient information and email body content to an external service without any visible disclosure, consent check, or user confirmation in this code path. Silent transmission to a third party is dangerous because it can leak analysis results, identifiers, or other embedded data without the user's awareness.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The code accesses a sensitive credential file from the user's home directory with no disclosure or permission check. Undisclosed secret access is risky because users and operators may not expect the skill to touch unrelated local credentials, and such access can facilitate further unauthorized network actions.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/lib/email.js:12