xaut-trade

• Outcome: Review
• Latest audit: May 29, 2026 · 9:33 PM UTC
• Version: 2.3.0

Overview

This is a real wallet-enabled trading skill whose core behavior is mostly disclosed, but it includes an under-documented arbitrary signing capability and broad delegation triggers that deserve manual review before installation.

Install only if you are comfortable giving this skill local wallet-signing authority. Review the helper scripts before use, keep `~/.aurehub/.env` and password files private with 0600 permissions, avoid enabling rankings if you do not want your wallet linked to a nickname, and do not use the generic signing command unless you can independently verify exactly what the EIP-712 payload authorizes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill clearly exercises sensitive capabilities—shell execution, environment-file access, and network communication—yet does not declare permissions. That makes the trust boundary opaque to users and host systems, increasing the chance of silent over-privilege and unsafe execution in environments that rely on manifest-level permissions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose understates and misstates behavior: the skill can access wallet material indirectly, guide seed export, create/list accounts, persist local state, install/configure dependencies, and transmit ranking data, while also claiming delegation features not actually evidenced here. Security review and user consent depend on accurate scope; a mismatch can cause operators to authorize a much more powerful skill than they intended.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The trigger/description expands the skill beyond XAUT trading into unrelated domains like Polymarket and Hyperliquid. Broadening scope increases the chance that users invoke this high-privilege trading skill for unrelated intents, which can route them into unexpected behaviors or future delegated actions outside the advertised trust boundary.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The intent logic explicitly routes arbitrary non-XAUT intents into external skill delegation. In a wallet-capable skill, this creates a confused-deputy risk: unrelated user requests may be handled by other components under the authority and context of a sensitive financial tool.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The onboarding explicitly offers an opt-in feature that sends the user's wallet address and nickname to an external website unrelated to core trade execution. Even though it is framed as optional, it expands data sharing beyond what is necessary and creates an avoidable privacy exposure for users engaging in financial activity.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The setup script includes an optional activity-ranking feature that sends the user's wallet address and nickname to an external site unrelated to the core wallet/trading setup path. Even though it is opt-in and disclosed, it expands data sharing beyond the stated trading purpose and creates unnecessary privacy and deanonymization risk for wallet owners.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The leaderboard/identity-sharing prompt is functionally outside the core purpose of buying and selling XAUT and encourages linking a persistent nickname to a wallet address. In a crypto context, that linkage can reduce user privacy and expose trading activity to profiling or targeting.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The CLI exposes a generic `sign` command that signs arbitrary EIP-712 typed data loaded from a file, which is broader than the documented XAUT trading workflow. In an agent skill context, arbitrary typed-data signing can authorize off-chain orders, token permits, or other approvals unrelated to XAUT, enabling phishing-style abuse or unintended delegation of wallet authority.

Description-Behavior Mismatch

Medium

• Confidence: 75% confidence
• Finding: The CLI includes a `cancel-nonce` transaction capability that sends calldata directly to Permit2's `invalidateUnorderedNonces`, but this sensitive wallet-management action is not described in the manifest. Hidden transaction-capable features increase the attack surface and can be invoked by higher-level tooling or prompts without users understanding that the skill can alter nonce state on-chain.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The file-level usage documentation omits the supported `sign` and `cancel-nonce` commands even though both are accepted by `VALID_COMMANDS` and perform sensitive cryptographic or on-chain actions. This mismatch is dangerous because reviewers, users, and agent orchestrators may rely on the visible documentation and miss hidden capabilities that can sign arbitrary payloads or submit transactions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README encourages immediate live trading in the quick-start path without prominently warning that sub-threshold trades may execute after only a preview and no blocking confirmation. In a financial trading skill that can spend real assets, this creates a realistic risk of unintended fund movement from ambiguous prompts, user misunderstanding, or agent misparse.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger list contains broad phrases like 'long', 'short', 'setup wallet', and 'bet on', which are likely to match ordinary conversation. Over-broad invocation is dangerous here because this skill has access to shell commands, environment files, wallet setup paths, and on-chain trading flows.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The keyword triggers include generic phrases like 'place limit order' and 'cancel order' without requiring XAUT or a trading-domain qualifier. In a multi-skill agent, this can cause unintended activation and route unrelated order-management requests into a wallet-enabled trading skill, increasing the chance of confusing the user or initiating sensitive financial workflows in the wrong context.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The regex pattern 'wait.*drop.*XAUT' is overly permissive and can match loosely related language without confirming that the user intends a trading action. In this skill's context, broad matching is more dangerous because the skill can progress into market or limit-order workflows involving real funds, so false activation has meaningful financial consequences.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document repeatedly instructs operators to run `source ~/.aurehub/.env`, which imports all variables from a local secrets file into the shell before additional commands execute. In a trading skill that handles wallets and external scripts, this increases exposure of API keys, private configuration, or wallet-related secrets to child processes, logs, error output, or any compromised helper script, and there is no explicit warning or minimization guidance for sensitive environment access.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The documentation instructs users to `source ~/.aurehub/.env` before running commands, which imports all variables from a local secrets file directly into the interactive shell. While this is a common workflow, it can unnecessarily expose API keys, private wallet material, or other credentials to child processes and shell history/debug output, increasing the blast radius if the terminal session or invoked tooling is compromised.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The runbook encourages initiating real mainnet trading from short, natural-language chat phrases like 'buy 10 USDT worth of XAUT' and says the agent should drive the workflow end-to-end with minimal manual work. In a chat-first agent context, broad, ordinary phrasing increases the chance of accidental invocation, prompt confusion, or social-engineered trade execution, especially because the action is financial and on-chain.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document opens by promoting a real on-chain workflow with minimal manual work but does not immediately warn about irreversible financial loss, approval risk, wallet compromise, or sensitive credential handling. For a skill that can move funds and involves wallet setup, missing upfront safety language can lead users to proceed without understanding the consequences or the need to protect secrets.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instructions tell the user to append a live API key to a plaintext file on disk without clearly warning that this creates a local secret at rest. On multi-user systems, in backups, or via accidental file disclosure, the key could be exposed and abused for API usage or account activity.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The registry includes broad natural-language triggers such as "bet on," "long," and "short," which can match ordinary conversation rather than clear user intent to invoke another trading skill. In this skill, delegation changes execution path into external installed skills, so an overly broad match can cause unintended handoff of financially sensitive actions or suppress the intended XAUT flow.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation tells users to configure a password file for the wallet vault but does not warn that the file itself becomes a high-value secret. If that file is stored with weak filesystem permissions, committed to source control, or exposed through backups/logs, an attacker who also obtains the encrypted wallet material can decrypt or unlock the wallet and spend funds.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The Foundry mode instructions require a keystore password file but provide no guidance on credential handling risks. In a trading skill that can execute blockchain transactions, disclosure of the password file can enable wallet unlocking and unauthorized trades if the keystore is also accessible, making credential hygiene especially important.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: `runSign` reads arbitrary JSON from a file and immediately produces a signature with `signTypedData` without any user-facing warning, schema validation, or display of what is being authorized. In a wallet-enabled agent skill, this makes social engineering and prompt-injection more dangerous because a crafted file can obtain a valid signature for permits, orders, or delegations that users do not recognize.

External Transmission

Medium

• Category: Data Exfiltration

Content

- Register:
   ```bash
   NICKNAME_ESC=$(printf '%s' "$NICKNAME" | sed 's/\\/\\\\/g; s/"/\\"/g')
   REGISTER_RESP=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
     https://xaue.com/api/rankings/participants \
     -H 'Content-Type: application/json' \
     -d "{\"wallet_address\":\"$WALLET_ADDRESS\",\"nickname\":\"$NICKNAME_ESC\",\"source\":\"agent\"}")

• Confidence: 92% confidence
• Finding: The skill sends wallet address and nickname to a third-party rankings service via curl. Although framed as opt-in, it still constitutes external transmission of identifying wallet metadata from a financial skill, and the skill also persists opt-in state locally, which raises privacy and consent sensitivity.

Credential Access

High

• Category: Privilege Escalation

Content

Fail -> copy from config.example.yaml (see onboarding Step C1) or redirect to setup.
4. **If `WALLET_MODE=wdk`:**
   - Check `~/.aurehub/.wdk_vault` exists: `ls ~/.aurehub/.wdk_vault`
   - Check `WDK_PASSWORD_FILE` in .env and file readable: `source ~/.aurehub/.env && test -r "$WDK_PASSWORD_FILE" && echo OK || echo FAIL`
   - Check Node.js >= 18: `node -v`
   - WDK mode has zero `cast` dependency
5. **If `WALLET_MODE=foundry`:**

• Confidence: 90% confidence
• Finding: This duplicate finding points to the same sensitive pattern: reading environment configuration and validating wallet password-file accessibility. In context, that creates a powerful credential-adjacent access path in a skill that can already initiate financial transactions.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal (+1 more)

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/lib/__tests__/create-wallet.test.js:24

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/limit-order.js:186

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/limit-order.js:134

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/setup.sh:589

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/__tests__/wallet-init.test.js:31

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/lib/__tests__/create-wallet.test.js:152

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/lib/__tests__/signer.test.js:109

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: references/live-trading-runbook.md:18