QStrader - AI Trading Assistant

• Outcome: Review
• Latest audit: Sep 15, 2026 · 2:23 AM UTC
• Version: 1.0.0

Overview

This is a real broker-connected trading skill with disclosed trading behavior, but it publishes an unauthenticated trading endpoint and relies on weak procedural safety controls for potentially live orders.

Review this carefully before installing. Use only a demo or tightly limited broker account unless the MCP server has real authentication, per-operation authorization, and server-side confirmation for every trade. Rotate the published endpoint if it is live, avoid sourcing untrusted .env files, and do not rely on the included risk_manager.py as a hard financial safety control without fixing and testing its loss-limit logic.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/mcp-endpoints.md:5

Finding

Hard-Coded Unauthenticated MCP Trading Endpoint

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/risk_manager.py:169

Finding

Documented Hard Position-Loss Limit Fails Open

Content

View full analysis

MAX_POSITION_LOSS: warnings.append( f"⚠️ Потенциальный убыток ${position_loss:.0f} > лимит ${MAX_POSITION_LOSS}. " "Уменьши объём или подтяни SL." ) approved = len(errors) == 0 ``` ### Technical Analysis `MAX_POSITION_LOSS` is documented as a hard limit, but exceeding it only adds a warning. Approval depends exclusively on whether `errors` is empty. Consequently, a trade with a calculated potential loss above the configured maximum can still return: ```json {"approved": true} ``` The check also calculates loss as `abs(price - stop_loss) * volume`, which does not account for contract size, tick value, quote currency conversion, commissions, leverage, or instrument-specific rules. This may materially underestimate exposure. In addition, the implementation does not enforce the documented minimum reward-to-risk ratio of 2:1 and does not verify that stop-loss and take-profit values are on the correct side of the entry price. ### Attack Path 1. A caller supplies a large volume or a stop loss far from the entry price. 2. The calculated `position_loss` exceeds `MAX_POSITION_LOSS`. 3. The script records only a warning rather than an error. 4. No other validation error is generated. 5. `approved` is set to `True`. 6. An agent or downstream workflow treats the successful exit status and approval result as authorization to proceed with the trade. ### Impact Assessment The flaw does not grant operating-system privileges. Its impact is within the connected trading account: orders that violate the stated maximum-loss policy may be approved and subsequently submitted. Depending on instrument contract size and leverage, the actual loss can substantially exceed both the displayed estimate and the configured `$100` limit. ]]>

Remediation

View remediation

MAX_POSITION_LOSS`. 2. Reject trades when exposure cannot be calculated reliably. 3. Retrieve trusted instrument metadata, including contract size, tick size, tick value, quote currency, leverage, and minimum volume. 4. Calculate worst-case loss using broker-consistent valuation and currency conversion. 5. Enforce stop-loss direction: - Buy: stop loss below entry. - Sell: stop loss above entry. 6. Enforce take-profit direction and a reward-to-risk ratio of at least 2:1. 7. Make warnings non-approvable unless a separately authenticated override process exists. 8. Add unit and integration tests proving that every documented hard-limit violation returns `approved: false` and a nonzero process exit status. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/risk_manager.py:149

Finding

Daily-Loss Control Uses Current Equity Drawdown Instead of Daily P&L

Content

View full analysis

= MAX_DAILY_LOSS: errors.append( f"❌ Дневной убыток {daily_loss_pct:.1%} (${current_loss_usd:.0f}) >= {MAX_DAILY_LOSS:.0%} " f"(${max_loss_usd:.0f}). СТОП ТОРГОВЛИ НА ДЕНЬ!" ) elif daily_loss_pct >= MAX_DAILY_LOSS * 0.8: warnings.append( f"⚠️ Дневной убыток {daily_loss_pct:.1%} — близко к лимиту {MAX_DAILY_LOSS:.0%}" ) ``` ### Technical Analysis The calculation `(balance - equity) / balance` measures current unrealized drawdown relative to the current balance. It does not measure total loss since the beginning of the trading day. Once a losing position is closed, its loss is reflected in the new balance. Equity may then become approximately equal to that lower balance, causing the calculated “daily loss” to return to zero. Repeated realized losses can therefore evade the documented 2% daily stop. The implementation does not retrieve a start-of-day balance or equity snapshot and does not aggregate realized and unrealized daily profit and loss. ### Attack Path 1. The account begins the day with a known equity value. 2. A position incurs a loss. 3. The losing position is closed, realizing the loss and reducing the account balance. 4. Current equity becomes approximately equal to the newly reduced balance. 5. The script calculates `(balance - equity) / balance`, producing a value near zero. 6. The risk check approves additional trades even though cumulative daily losses may already exceed 2%. 7. The process can repeat, allowing cumulative losses to grow beyond the stated daily limit. ### Impact Assessment The affected ...[truncated 354 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup.sh:28

Finding

Arbitrary Shell Execution Through Sourced Environment File

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:33

Finding

Unpinned Global Package Installation and Execution Guidance

Content

View full analysis

/dev/null; then echo "❌ mcporter не установлен." echo " Установите: npm install -g mcporter" echo " Или: npx mcporter ..." ``` ### Technical Analysis The setup output recommends globally installing or directly executing `mcporter` without a pinned version, lockfile, integrity hash, or verified source. `npm install -g mcporter` resolves the current registry version at installation time, while `npx mcporter` may download and execute a package dynamically. This creates dependency drift and supply-chain risk. A compromised package release, registry account, or package-resolution path could result in unexpected code executing during installation or invocation. Although the script prints these commands rather than executing them automatically, users are explicitly directed to run them as part of setup. ### Attack Path 1. An attacker compromises the relevant package, publisher account, or package distribution path. 2. A user runs the unpinned command recommended by the setup script. 3. npm resolves the attacker-controlled or compromised current package version. 4. Installation scripts or the package executable run with the user's permissions. 5. The malicious package accesses local files, environment variables, MCP configuration, or other user resources. ### Impact Assessment A compromised dependency could execute arbitrary code as the installing user. A global installation can also affect other projects and sessions that invoke the same command. Potentially exposed resources include OpenClaw workspace files, API keys, MCP configuration, and any broker-related credentials available to the user. Exploitation depends on compromise or substitution of the external dependency. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (38)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The declared description presents a broad automated trading assistant with multiple operational capabilities, including execution and risk workflows. The supplied code chunk has a much narrower purpose: market analysis for a ticker using technical analysis and LSTM prediction, plus fetching account data as context. While this partially aligns with the 'market analysis' aspect of the description and does use an MCP-connected workflow, the code does not substantiate most of the described assistant functionality. This is a description-to-behavior mismatch because the actual implemented behavior is materially narrower than the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a full-featured automated trading assistant with analysis, risk controls, execution, monitoring, and journaling. The supplied code only implements one narrow function: trade journaling/logging. While trade journaling is mentioned in the description, the primary purpose and capabilities of the code chunk are far more limited than the declared skill. There is no evidence of market analysis, position management, portfolio monitoring, news handling, or broker-backed trade execution. The code accesses a Qdrant journaling endpoint through mcporter, which is materially different from the described n8n MCP-based automated hedge fund behavior.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The setup instructions explicitly direct creation and population of a .env file containing user keys. In a skill that also relies on shell access and broker-connected tooling, this increases the risk that secrets are stored locally in plaintext and later exposed through logs, shell commands, mis-scoped tools, or accidental repository inclusion.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

bash

cd skills/qstrader
cp .env.example .env  # Заполнить свои ключи
bash scripts/setup.sh

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 44)May include surrounding context.

md

echo "🔶 QStrader Setup"
echo "=================="

# 1. Проверка .env
if [ ! -f "$SKILL_DIR/.env" ]; then
    if [ -f "$SKILL_DIR/.env.example" ]; then
        cp "$SKILL_DIR/.env.example" "$SKILL_DIR/.env"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 12)May include surrounding context.

sh

echo "🔶 QStrader Setup"
echo "=================="

# 1. Проверка .env
if [ ! -f "$SKILL_DIR/.env" ]; then
    if [ -f "$SKILL_DIR/.env.example" ]; then
        cp "$SKILL_DIR/.env.example" "$SKILL_DIR/.env"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 16)May include surrounding context.

sh

echo "🔶 QStrader Setup"
echo "=================="

# 1. Проверка .env
if [ ! -f "$SKILL_DIR/.env" ]; then
    if [ -f "$SKILL_DIR/.env.example" ]; then
        cp "$SKILL_DIR/.env.example" "$SKILL_DIR/.env"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 13)May include surrounding context.

sh

echo "=================="

# 1. Проверка .env
if [ ! -f "$SKILL_DIR/.env" ]; then
    if [ -f "$SKILL_DIR/.env.example" ]; then
        cp "$SKILL_DIR/.env.example" "$SKILL_DIR/.env"
        echo "✅ Создан .env из шаблона. Заполните свои ключи:"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 15)May include surrounding context.

sh

echo "=================="

# 1. Проверка .env
if [ ! -f "$SKILL_DIR/.env" ]; then
    if [ -f "$SKILL_DIR/.env.example" ]; then
        cp "$SKILL_DIR/.env.example" "$SKILL_DIR/.env"
        echo "✅ Создан .env из шаблона. Заполните свои ключи:"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 17)May include surrounding context.

sh

echo "=================="

# 1. Проверка .env
if [ ! -f "$SKILL_DIR/.env" ]; then
    if [ -f "$SKILL_DIR/.env.example" ]; then
        cp "$SKILL_DIR/.env.example" "$SKILL_DIR/.env"
        echo "✅ Создан .env из шаблона. Заполните свои ключи:"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 29)May include surrounding context.

sh

echo "=================="

# 1. Проверка .env
if [ ! -f "$SKILL_DIR/.env" ]; then
    if [ -f "$SKILL_DIR/.env.example" ]; then
        cp "$SKILL_DIR/.env.example" "$SKILL_DIR/.env"
        echo "✅ Создан .env из шаблона. Заполните свои ключи:"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 48)May include surrounding context.

sh

echo "=================="

# 1. Проверка .env
if [ ! -f "$SKILL_DIR/.env" ]; then
    if [ -f "$SKILL_DIR/.env.example" ]; then
        cp "$SKILL_DIR/.env.example" "$SKILL_DIR/.env"
        echo "✅ Создан .env из шаблона. Заполните свои ключи:"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

source "$SKILL_DIR/.env" executes the .env file as shell code, not just parses key-value pairs. If the .env file is maliciously modified or contains shell substitutions/commands, running setup will execute arbitrary code in the user's environment; in a trading skill with broker-connected infrastructure, that could enable credential theft, system compromise, or unauthorized trading actions.

Content

Scanner excerpt · scripts/setup.sh (reported line 26)May include surrounding context.

sh

exit 1
    fi
fi
echo "✅ .env найден"

# Загрузить переменные
set -a; source "$SKILL_DIR/.env"; set +a

Credential Access

High

• Category: Privilege Escalation
• Confidence: 77% confidence

Finding

On failure, the script prints TEST_RESULT, which may include server responses, identifiers, or sensitive account-related error details returned by Get_account_data. In the context of a trading assistant wired to broker-accessible MCP infrastructure, verbose output can leak operational or financial metadata into terminal history, logs, CI output, or shared support captures.

Content

Scanner excerpt · scripts/setup.sh (reported line 64)May include surrounding context.

sh

TEST_RESULT=$(mcporter call my-n8n-mcp.Get_account_data 2>&1 || echo "FAILED")
if echo "$TEST_RESULT" | grep -q "error\|FAILED\|ECONNR"; then
    echo "❌ Не удалось подключиться к n8n MCP"
    echo "   Проверьте N8N_MCP_URL в .env"
    echo "   Ответ: $TEST_RESULT" | head -5
else
    echo "✅ Подключение успешно!"

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language instructions and usage documentation are presented in Russian throughout the file, but the README does not indicate that the user can choose another language or that the locale restriction is intentional and justified. This can violate language/locale policy when a skill effectively forces one language without opt-in.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 35)May include surrounding context.

bash

# Если у тебя .skill файл:
mkdir -p ~/.openclaw/workspace/skills/qstrader
tar -xzf qstrader.skill -C ~/.openclaw/workspace/skills/

# Или скопировать папку qstrader/ в skills/

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 35)May include surrounding context.

bash

# Ecли y тe6я .skill фaйл:
mkdir -p ~/.openclaw/workspace/skills/qstrader
tar -xzf qstrader.skill -C ~/.openclaw/workspace/skills/

# Или cкoпиpoвaть пaпкy qstrader/ в skills/

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README says the agent will request human confirmation before placing orders, but this is described only as policy text and not as an enforced control. In a trading skill with direct broker write endpoints, a non-enforced confirmation step can be bypassed by agent behavior, prompt errors, or integration mistakes, leading to unauthorized live trades.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is described as activating automatically and handling analysis, risk checks, confirmations, and logging based on broad natural-language requests. In the context of broker-connected automation, vague activation boundaries increase the chance of accidental invocation of sensitive workflows, including trade preparation or execution paths.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The README exposes register_new_user and get_access_token endpoints as part of a trading skill even though they are not necessary for the stated market-analysis and trade-execution workflow. Unrelated auth/account endpoints expand the accessible attack surface and may let an agent or operator invoke identity or token flows that were not intended for this skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents use of shell commands, environment files, and broker-connected MCP operations, but does not declare any tool restrictions such as allowed-tools or permissions. In a trading skill, missing scope boundaries is dangerous because an agent may be granted broader shell/env access than necessary and could reach credentials or execute unintended commands during setup or trade workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file presents the skill title, workflows, and safety instructions entirely in Russian, which can force a specific language on users. The policy allows locale constraints only when they are explicitly justified or when users are given a language/locale choice, neither of which is stated here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill states that any order requires user confirmation, yet later provides direct trade placement commands in the documented workflow. In the context of a broker-connected trading assistant, this inconsistency can lead an agent or operator to place real orders without a reliable confirmation control, creating immediate financial-loss risk.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The title and all operational instructions are presented in Russian, with no indication that another language is supported or that the user can opt into this locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.