Back to skill

Security audit

Pinescript mastery

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Pine Script coding helper with no executable installer, hidden access, persistence, or credential handling.

Install this only if you want the assistant to help write TradingView Pine Script and trading-strategy examples. Review any generated strategy carefully, because code and backtests are not financial advice and should be validated before any live trading use.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger criteria are broad enough to activate on general trading-idea discussions even when the user did not explicitly ask for Pine Script help. That can cause unintended skill invocation, steering conversations into code generation or strategy-design behavior outside user intent and increasing the chance of inappropriate, overconfident financial or technical guidance.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The anti-pattern guidance states that calling plot() inside a conditional is a Pine Script error because it is in local scope, and prescribes using a ternary instead. However, the manifest explicitly claims support for Pine Script v6 and 2025 updates including unlimited local scopes, so this documentation contradicts the advertised modern feature support and could steer users toward outdated constraints.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.