ClawHub
Back to skill

Security audit

Cex Trader

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed crypto trading skill, but it can send exchange credentials to an MCP server and place real spot or leveraged futures trades, so it needs careful review before use.

Install only if you deliberately want an agent to trade on real OKX or Binance accounts. Use dedicated trade-only API keys with withdrawals and transfers disabled, enable exchange IP allowlisting where possible, start with demo/testnet or very small balances, verify the MCP endpoint before sending credentials, and require your own explicit confirmation before any order, leverage change, or position close.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tainted flow: 'req' from os.environ.get (line 36, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            return json.loads(resp.read().decode())
    except urllib.error.HTTPError as e:
        body = e.read().decode()
Confidence
94% confidence
Finding
The CLI constructs its destination URL from the MCP_SERVER_URL environment variable and then sends requests to it with urllib.request.urlopen without enforcing HTTPS, validating the host, or constraining the destination. In this skill, that is especially dangerous because the same client transmits exchange API credentials and trading commands, so an attacker who can influence the environment can redirect secrets and order flow to a malicious server or unintended internal endpoint.

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill exposes high-risk capabilities—environment access for API keys and network access to a remote MCP endpoint that can receive credentials and execute trading actions—without an explicit permissions declaration. In a trading skill, this is especially dangerous because users may not realize the skill can transmit exchange credentials off-host and initiate real financial transactions through a hosted server.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger phrases are extremely broad (for example, 'buy crypto', 'sell crypto', 'swap tokens', 'binance trade', 'close position') and overlap with ordinary user requests, making accidental invocation plausible. Because this skill can place spot and futures orders and manage leverage/positions, unintended activation could lead directly to unauthorized or mistaken financial trades with real monetary loss.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The examples demonstrate live futures trading actions including leverage changes, market orders, shorts, and full position closure without any explicit warning that these operations can cause rapid losses or irreversible execution. In an agent-facing trading skill, copy-pasteable examples materially increase the chance that a user or downstream agent executes risky actions in production without adequate confirmation or sandboxing.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The example file demonstrates live trading actions such as placing and canceling spot orders without any explicit warning that these operations may execute against real exchange accounts. In an agent-integrated trading skill, users or downstream systems may copy these examples directly, increasing the risk of unintended real-money trades, asset loss, or mistaken assumptions that the examples are simulated.

Missing User Warnings

High
Confidence
98% confidence
Finding
The setup command accepts API keys and secret keys as command-line arguments and forwards them to the server over whatever MCP_SERVER_URL is configured, which defaults to plain HTTP. In a trading skill, these credentials are highly sensitive: they may be exposed via shell history, process listings, logs, or network interception, enabling full account compromise and unauthorized trades.

Static analysis

No suspicious patterns detected.