ClawHub
Back to skill

Security audit

Mt4 Trader

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed MT4 trading bridge, but it asks users to install unverified trading binaries and enables high-impact live trading actions without enough safeguards.

Review carefully before installing. Use only a demo or tightly limited account unless you independently trust and verify the EA binaries. Do not enable live trading or DLL imports for unverified files, pin and hash-check any downloaded .ex4 files, require explicit confirmation for every trade or bulk-close action, restrict the bridge directory to trusted local processes, and use only HTTPS allowlisted webhook endpoints for summaries.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/deploy_ex4.py:14
Finding

Mutable Third-Party Executables Are Installed Without Integrity Verification

Content
View full analysis
{dst}") ``` The associated documentation directs users to download the files from the mutable repository branch: ```text From Gitee: https://gitee.com/3603317/skill-plugin/tree/master/mt4 ``` ### Technical Analysis The effective MT4 components are precompiled `.ex4` binaries obtained from a personal, third-party Gitee repository. The URLs reference the mutable `master` branch rather than an immutable release or commit. The project does not provide expected cryptographic hashes, digital signatures, verified source code, or reproducible build instructions for these artifacts. The deployment script copies the downloaded files into MT4's `MQL4/Experts` and `MQL4/Libraries` directories without verifying their origin or integrity. The installation documentation subsequently instructs users to attach the EA and enable live trading and DLL imports. Consequently, the behavior of the effective trading payload can change after this source package has been reviewed. Although the script displays download links rather than down ...[truncated 1425 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/mt4_client.py:328
Finding

Global Auto-Trading Can Be Toggled Through Synthetic Keyboard Input and System Setting Changes

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/mt4_client.py:78
Finding

Trading Requests and Responses Use Predictable Unauthenticated Files Without Atomicity or Correlation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/position_summary_cron.py:33
Finding

Position and Account Metadata Can Be Sent to Unrestricted Plaintext Webhook Destinations

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (20)

Tainted flow: 'WEBHOOK_URL' from os.environ.get (line 33, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
91% confidence
Finding

The webhook destination is taken directly from an environment variable and used in an outbound HTTP request without validation or allowlisting. If an attacker can influence the runtime environment, they can redirect sensitive position summaries and account metadata to an attacker-controlled endpoint, creating an SSRF-style egress/data exfiltration path.

Content

Scanner excerpt · scripts/position_summary_cron.py (reported line 63)May include surrounding context.

python
"accountId": ACCOUNT_ID
    }
    try:
        resp = requests.post(WEBHOOK_URL, json=payload, timeout=10)
        if resp.status_code == 200:
            logger.info("消息发送成功")
            return True

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill exposes sensitive trading capabilities including market buys, position closure, and 'close all' functionality through conversational interfaces, but the documentation does not present clear safety gates, loss warnings, authorization controls, or human approval requirements. In financial trading, these are destructive operations that can cause immediate monetary loss if triggered accidentally, maliciously, or by misunderstood instructions.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md
# MT4 Bridge API Reference

## Symbols: XAUUSD.s (Gold), BTCUSD, XAGUSD, XTIUSD.s

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api_docs.md (reported line 1)May include surrounding context.

md
# MT4 Bridge API Reference

## Symbols: XAUUSD.s (Gold), BTCUSD, XAGUSD, XTIUSD.s

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code exposes direct trading and destructive account actions such as buy, sell, close, close_all, close_loss, and safe_close_all, but provides no confirmation prompt or user-facing warning before executing them. Because these operations can place or close live trades irreversibly, the absence of any disclosure or confirmation mechanism is a safety concern for a code file.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
91% confidence
Finding

The code can manipulate MT4 terminal-wide auto-trading state by programmatically sending Ctrl+E to the target window, affecting all strategies running in the terminal. In an agent skill context, this is dangerous because a caller can disable or enable trading globally without meaningful user consent, potentially causing unauthorized trading disruption or activation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises broad, colloquial natural-language commands such as '买黄金 0.05 手', '平仓 95832104', and '全平' that map directly to high-impact trading actions. In an agent setting spanning chat platforms, this creates a real risk of unintended or ambiguous invocation, prompt injection via conversational context, or acting on casual/user-quoted text without strong confirmation and intent verification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file lists live-trading actions such as buy, sell, close_all, cancel_order, and grid_close_all, but provides no warning that these operations can place, modify, or close market orders with real financial consequences. For markdown files, SQP-2 applies when the skill description omits warnings about behavior that could affect user data or system integrity; here the omitted disclosure is about potentially irreversible trading actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code file contains natural-language instructions and CLI help text exclusively in Chinese, and the same language is used in user-facing status/error messages throughout the script. Under the policy, forcing a specific language without user opt-in or a documented justification is a locale/language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring and usage instructions are entirely in Chinese, and the script's subsequent print messages follow the same pattern. This imposes a specific language on users without any documented opt-in or indication that the skill is intended only for a Chinese-language audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Several user-facing comments and instructional strings are written in Chinese, including path configuration and credential guidance, with no indication that language is configurable or optional. This can violate language/locale policy when a skill effectively forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/mt4_client.py (reported line 68)May include surrounding context.

python
time.sleep(0.5)
        logger.error("MT4 EA 超时 - 是否已加载 EA？")
        return False
    def _transact(self, request, symbol=None, timeout=None, poll_interval=None):
        发送请求到 EA 并等待响应。
        Args:
            request: 请求字典

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/mt4_client.py (reported line 283)May include surrounding context.

python
time.sleep(0.5)
        logger.error("MT4 EA 超时 - 是否已加载 EA？")
        return False
    def _transact(self, request, symbol=None, timeout=None, poll_interval=None):
        发送请求到 EA 并等待响应。
        Args:
            request: 请求字典

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/mt4_client.py (reported line 380)May include surrounding context.

python
_u32.EnumWindows(WNDENUMPROC(_enum_cb), 0)
        return _found[0] if _found else None
    def _send_ctrl_e(self, _u32, hwnd):
        SPI_SETFOREGROUNDLOCKTIMEOUT = 0x2001
        SPIF_SENDCHANGE = 0x0002
        _u32.SystemParametersInfoW(
            SPI_SETFOREGROUNDLOCKTIMEOUT, 0, 0, SPIF_SENDCHANGE

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code file contains natural-language operational documentation entirely in Chinese, including setup instructions and behavior description. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language locale violation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/position_summary_cron.py (reported line 63)May include surrounding context.

python
"accountId": ACCOUNT_ID
    }
    try:
        resp = requests.post(WEBHOOK_URL, json=payload, timeout=10)
        if resp.status_code == 200:
            logger.info("消息发送成功")
            return True

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code file contains its primary docstring, CLI descriptions, prompts, and status messages in Chinese, with no indication that the user can select another language. Under the policy for natural-language violations, forcing a specific language without user opt-in is a reportable issue unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The docstring frames the script as a deployment guide that prompts manual download and deployment steps, but the code includes an active deploy mode that writes files into detected MT4 directories. This is a mild contradiction in documented intent versus implemented behavior, even though the deployment capability is related to the script's topic.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file-level docstring and operational messages are written exclusively in Chinese, and the script emits Chinese user-facing logs and output context without indicating any language selection or opt-in. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This file’s natural-language content, including the module description, function docstring, and returned status messages, is entirely in Chinese. Under the stated policy, forcing a specific language without user opt-in or documented locale justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.