Kraken Exchange

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:03 AM UTC
• Version: 0.3.2

Overview

This Kraken skill is coherent for exchange access, but it combines real-money trading authority with broad activation, unpinned executable installation, plaintext credential handling, and recurring automation examples.

Review before installing. Use read-only Kraken API keys unless trading is necessary, never grant withdrawal or transfer permissions unless required, pin and verify the tentactl binary, avoid plaintext long-lived credentials when possible, and do not enable recurring trading without explicit limits, expiry, and manual approval controls.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:15
• Finding: Unpinned Third-Party Executable Receives Financial Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:15-21, 56-60`; execution occurs at `scripts/kraken.sh:11-14` and `scripts/kraken.py:23` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: High ### Vulnerable Code ```yaml "install": [ { "id": "cargo", "kind": "cargo", "package": "tentactl", "bins": ["tentactl"], "label": "Install tentactl via cargo (source: https://github.com/askbeka/tentactl)", }, ], ``` ```bash cargo install tentactl ``` The installed executable is subsequently located and launched: ```bash export KRAKEN_MCP_BINARY="${KRAKEN_MCP_BINARY:-$(command -v tentactl 2>/dev/null || echo "")}" [[ -z "$KRAKEN_MCP_BINARY" && -x "$HOME/.cargo/bin/tentactl" ]] && export KRAKEN_MCP_BINARY="$HOME/.cargo/bin/tentactl" [[ -z "$KRAKEN_MCP_BINARY" ]] && { echo "Error: tentactl not found. Install: cargo install tentactl" >&2; exit 1; } exec python3 "$SCRIPT_DIR/kraken.py" "$@" ``` ```python proc = subprocess.Popen([binary], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, text=True) ``` ### Technical Analysis The installation command retrieves the current `tentactl` package from the Cargo registry without pinning an exact version, using a lockfile, or verifying an artifact checksum or signature. The GitHub source reference in the documentation does not establish that the installed registry artifact corresponds to a reviewed and immutable source revision. The wrapper loads Kraken credentials into its environment before launching `tentactl`. The child process therefore inherits financial API credentials and is trusted to communicate with Kraken and perform sensitive operations. The documented tool set includes order placement, transfers, earn allocation, account changes, and withdrawals. Consequently, compromise of the dependency or its distribution channel would directly expose a high-value execution and credential boundary. This finding does not establish th ...[truncated 1816 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `tentactl` to an exact audited version: ```bash cargo install tentactl --version '=X.Y.Z' --locked ``` 2. Record the expected source revision and verify that the registry package corresponds to that revision. 3. Prefer signed release artifacts or reproducible source builds, and verify a publisher-provided SHA-256 checksum or cryptographic signature before execution. 4. Maintain a dependency review and update process rather than automatically consuming the latest version. 5. Use separate API keys for read-only, trading, futures, and other privileged operations. 6. Disable withdrawal, transfer, master-account, and key-management permissions unless a specific workflow requires them. 7. Run the dependency with a restricted environment and pass only the credentials required for the requested operation. 8. Consider sandboxing the executable with restricted filesystem and network access, allowing only documented Kraken endpoints. 9. Surface the exact dependency version and artifact digest in installation and diagnostic output so users can verify what is running. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/kraken.sh:7
• Finding: Credential Configuration File Is Executed as Arbitrary Shell Code<![CDATA[ ## Vulnerability Details **File Location**: `scripts/kraken.sh:7-9` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Medium ### Vulnerable Code ```bash # Load env vars ENV_FILE="${KRAKEN_ENV_FILE:-$HOME/.tentactl.env}" [[ -f "$ENV_FILE" ]] && { set -a; source "$ENV_FILE"; set +a; } ``` ### Technical Analysis The wrapper uses Bash `source` to load a file intended to contain credential data. `source` does not parse the file as a passive environment-file format; it evaluates every line as shell code in the current process. Command substitutions, function definitions, redirections, variable expansions, and arbitrary commands embedded in the file therefore execute with the privileges of the invoking user. The `KRAKEN_ENV_FILE` environment variable permits callers to select an alternative readable file. The normal setup script creates the default file with mode `600`, which reduces exposure but does not remove the code-execution behavior. Exploitation remains possible if the default file is modified through another local compromise, restored with unsafe ownership or permissions, or if an attacker can influence the path override or invoking environment. Because execution occurs before `tentactl` starts, injected commands can read or modify credentials, replace environment settings, alter the selected binary, or perform unrelated local actions. ### Attack Path 1. An attacker gains the ability to create or modify a candidate environment file, or to influence `KRAKEN_ENV_FILE` in the context where the wrapper is launched. 2. The attacker inserts shell syntax into that file, for example: ```bash KRAKEN_API_KEY=value KRAKEN_API_SECRET=value malicious_command ``` 3. The user invokes `scripts/kraken.sh`. 4. The wrapper resolves the attacker-controlled or tampered file and executes it through `source`. 5. The injected command runs in the wrapper's shell with the user's privileges before control is transferred to Pyth ...[truncated 904 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not use `source` or `.` to process credential files. 2. Parse the file strictly as data and allow only exact expected keys, such as `KRAKEN_API_KEY`, `KRAKEN_API_SECRET`, `KRAKEN_FUTURES_KEY`, and `KRAKEN_FUTURES_SECRET`. 3. Reject malformed lines, duplicate keys, command substitutions, shell metacharacters, and unexpected variable names. 4. Before reading the file, verify that it: - Is a regular file rather than a symbolic link. - Is owned by the current user. - Has no group or other permissions. - Resides at an approved path. 5. Remove `KRAKEN_ENV_FILE` if arbitrary path selection is unnecessary. If it is required, canonicalize the path and restrict it to an approved directory. 6. Prefer retrieving credentials directly from a credential manager at runtime rather than storing long-lived plaintext secrets. 7. If a file must be used, parse it with a non-evaluating implementation and construct a minimal explicit environment for the child process. 8. Add regression tests containing command substitutions and shell commands to verify that configuration content is never executed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (20)

Ae1

High

• Category: analysis-evasion

Content

See `references/tools.md` for full parameter docs on all 114 tools.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# Convenience wrapper. Loads .env and delegates to kraken.py.
# Usage: kraken.sh <tool_name> [json_arguments]

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill invokes shell commands and relies on environment-provided secrets, but it does not declare a restrictive tool scope such as allowed tools or permissions. In an agent environment, that omission increases the chance the skill is selected with broader-than-necessary execution capabilities, enabling unintended command execution or secret exposure if the skill is misused or composed with other prompts.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger description is broad enough to activate on generic crypto, trading, or portfolio-management requests, not just clearly Kraken-specific intent. That can route unrelated financial requests into a skill capable of account access and real-money trading, increasing the risk of overreach and accidental order placement in the wrong context.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
echo "KRAKEN_API_KEY=your-key" > ~/.tentactl.env
echo "KRAKEN_API_SECRET=your-secret" >> ~/.tentactl.env
chmod 600 ~/.tentactl.env
```

Or use the 1Password setup script: `scripts/setup-keys.sh`

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The automation example schedules recurring crypto purchases and includes language suggesting eventual execution after validation, but it does not require fresh user approval for each run. In a real-money trading context, recurring unattended execution can lead to unauthorized or unexpected trades, especially if market conditions or user intent change.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

### `cancel_all_after`

Dead man's switch: cancel all orders after timeout seconds. Set timeout=0 to disable. Call every 15-30s with timeout=60 for protection. Requires API keys.

**Parameters:**
```json

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

### `cancel_all_after`

Dead man's switch: cancel all orders after timeout seconds. Set timeout=0 to disable. Call every 15-30s with timeout=60 for protection. Requires API keys.

**Parameters:**
```json

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The `wf_batch_order` tool is explicitly marked as REAL MONEY and can submit send/cancel/edit futures instructions in bulk, but its description does not require explicit user confirmation before execution. In an agent setting, omission of a confirmation guard materially increases the chance of unauthorized or accidental trading actions with immediate financial consequences, especially because batch instructions can bundle multiple operations in one call.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

notif = json.dumps({"jsonrpc":"2.0","method":"notifications/initialized"})
call = json.dumps({"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":tool,"arguments":args}})

proc = subprocess.Popen([binary], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, text=True)
proc.stdin.write(init + "\n" + notif + "\n" + call + "\n")
proc.stdin.flush()

• Confidence: 95% confidence
• Finding: The script launches an external executable, which is expected for a wrapper, but the executable path is not fixed or authenticated. Because the binary can be selected via environment variable or PATH lookup, an attacker who can influence the runtime environment can cause arbitrary code execution under the user's privileges.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This script launches an external binary via subprocess based on runtime input and an environment variable, but it provides no confirmation prompt, user-facing log, or warning comment about that execution. For a code file, subprocess execution is a safety-relevant operation that should have some visible disclosure unless clearly communicated elsewhere.

Tainted flow: 'binary' from os.environ.get (line 8, credential/environment) → subprocess.Popen (code execution)

Medium

• Category: Data Flow

Content

notif = json.dumps({"jsonrpc":"2.0","method":"notifications/initialized"})
call = json.dumps({"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":tool,"arguments":args}})

proc = subprocess.Popen([binary], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, text=True)
proc.stdin.write(init + "\n" + notif + "\n" + call + "\n")
proc.stdin.flush()

• Confidence: 99% confidence
• Finding: The value passed to subprocess.Popen is derived from KRAKEN_MCP_BINARY, an environment-controlled input, with no trust boundary enforcement. In environments where attackers can set or influence environment variables, this becomes a direct arbitrary program execution primitive and is especially sensitive here because the tool may access cryptocurrency account data and trading functions.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script automatically sources an environment file using Bash `source`, which executes arbitrary shell code in that file rather than merely parsing key/value pairs. If an attacker can modify `~/.tentactl.env` or influence `KRAKEN_ENV_FILE`, they can achieve code execution whenever the wrapper runs, and this is especially sensitive in a crypto-trading skill that may hold exchange API credentials and execute trades.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# Setup Kraken API keys from 1Password or manual input.
# Stores them in ~/.tentactl.env (chmod 600).

set -euo pipefail

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# Setup Kraken API keys from 1Password or manual input.
# Stores them in ~/.tentactl.env (chmod 600).

set -euo pipefail

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# Setup Kraken API keys from 1Password or manual input.
# Stores them in ~/.tentactl.env (chmod 600).

set -euo pipefail

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# Setup Kraken API keys from 1Password or manual input.
# Stores them in ~/.tentactl.env (chmod 600).

set -euo pipefail

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script extracts secrets from 1Password using --reveal and immediately converts them into plaintext environment file entries without explicitly disclosing that handling to the user. This defeats some of the protection users expect from a password manager by moving credentials into a less protected, persistent local file. Because these are Kraken API credentials for a trading integration, the operational risk is higher than ordinary application tokens.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script persists Kraken API credentials to ~/.tentactl.env without an explicit warning that the secrets will be stored on disk for future reuse. Even with chmod 600, local plaintext storage increases exposure to backup leakage, accidental sourcing, shell tooling disclosure, or compromise of the user account. In a cryptocurrency trading skill, exposed API keys can enable account access and potentially unauthorized trading or fund movement depending on key permissions.

Excessive Permissions

Low

• Category: Privilege Escalation

Content

Or use the 1Password setup script: `scripts/setup-keys.sh`

**Key permissions:** Create keys at https://www.kraken.com/u/security/api
- Read-only: enable **Query Funds** and **Query Open Orders & Trades**
- Trading: also enable **Create & Modify Orders**

• Confidence: 80% confidence
• Finding: Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Static analysis

No suspicious patterns detected.