Security audit

Web3 Trader

Security checks for vulnerabilities and agentic risk

Overview

This is a real Web3 swap helper, but it asks for high-impact trading authority while giving inconsistent automation, hosting, and risk-control instructions.

Review this carefully before installing. Treat it as a high-impact financial automation skill: use only small test amounts, verify every wallet prompt, avoid the delegated Hyperliquid Agent Wallet flow unless you understand and accept ongoing trading authority, and do not upload wallet-specific swap pages to public hosts. Prefer an isolated Python environment and inspect installer/dependency changes before use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:657
Finding: Mandatory Brand Attribution Hijacks Agent Output
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: install.sh:1
Finding: Installer Recommends Piping Mutable Remote Content Directly into a Shell
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/swap_page_gen.py:284
Finding: Remote Transaction Fields Are Injected into Executable JavaScript Without Context-Safe Serialization
Content: View full analysis
Remediation: View remediation
`, and malformed hexadecimal data. - Independently verify that the transaction destination is an expected 0x contract before page generation. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/zeroex_client.py:250
Finding: Documented Financial Risk Limits Are Not Enforced by the Runtime
Content: View full analysis
0.5% max_amount_usdt: 10000 # Reject if trade > $10k ``` However, client creation only consumes the API key and chain configuration: ```python def create_client() -> ZeroExClient: """Create ZeroExClient from user config""" config = load_config() api_key = config.get("api_keys", {}).get("zeroex") if not api_key or api_key == "YOUR_0X_API_KEY": raise ValueError( "Missing Antalpha AI API key. Set it in ~/.web3-trader/config.yaml\n" "Get your key from https://dashboard.0x.org" ) chain_name = config.get("chains", {}).get("default", "ethereum") chain_id = CHAIN_IDS.get(chain_name, 1) return ZeroExClient(api_key=api_key, chain_id=chain_id) ``` The CLI accepts arbitrary floating-point amounts without checking the configured limit: ```python p.add_argument("--amount", type=float, required=True) ``` ### Technical Analysis The project documents `max_slippage` and `max_amount_usdt` as controls that reject unsafe trades, but runtime code never reads or enforces the `risk` configuration block. Quote requests also do not pass an explicit configured slippage parameter. This creates a security-control mismatch: users can configure limits and reasonably believe they are protected, while the application continues to build transactions for values beyond those limits. In a financial application, silent failure to enforce advertised controls can materially affect user decisions. ### Attack Path 1. A user configures a maximum trade amount or slippage limit. 2. The Agent or user invokes a CLI command with an am ...[truncated 798 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/local-cli.md:14
Finding: Wallet-Specific Transaction Pages Are Uploaded to Anonymous Third-Party Hosting
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unpinned Dependencies Are Installed into the Active Python Environment
Content: View full analysis
=2.28.0 web3>=6.0.0 qrcode>=7.0 pillow>=9.0 pyyaml>=6.0 ``` The installer resolves and installs those mutable dependency versions directly: ```bash # Install Python dependencies echo "📦 Installing Python dependencies..." cd "$SKILL_DIR" pip3 install -r requirements.txt --quiet ``` ### Technical Analysis Every dependency uses only a lower version bound. A future release of any direct or transitive package can therefore be selected without further review. The dependency file provides no hashes, lock file, trusted index restriction, or reproducible resolution metadata. The installer also invokes `pip3` in the active environment rather than creating a dedicated virtual environment. This can overwrite packages used by other applications or cause the Skill to execute against unexpected dependency versions. The package names shown are established packages rather than obvious typosquatting or dependency-confusion names. The risk is therefore insecure and mutable dependency resolution, not evidence that the listed packages are presently malicious. ### Attack Path 1. A direct or transitive dependency publishes a compromised future release, or its distribution account is taken over. 2. A user runs `install.sh`. 3. `pip3` resolves the newest versions satisfying the broad `>=` constraints. 4. The compromised package or installation hook executes with the invoking user’s privileges. 5. The package can access the same files, network resources, API-key configuration, and workspace available to that user. A non-malicious incompatible release could follow the same resolution path and break transaction construction or validation. ### Impact Assessment A malicious dependency can execute arbitrary Py ...[truncated 351 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (46)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents an end-user trading skill focused on DEX swaps, Hyperliquid limit/perpetual trading, wallet integrations, and risk controls. The supplied code chunk does not implement any of those trading behaviors. Instead, it is an installation/setup script that prepares directories, copies a config file, installs dependencies, and references a 0x API key. That is a materially different primary purpose from the declared trading functionality. While installer logic can be a supporting detail for a skill, this chunk specifically exposes undeclared setup/configuration behavior and reveals an integration target (0x API) inconsistent with the stated Antalpha AI/Hyperliquid-centric description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description claims a broad DEX trading skill with v1 aggregator swaps and v2 advanced trading capabilities such as Hyperliquid limit orders, perpetuals, risk control, balance checks, and failure-tolerant order management. The supplied code does not implement those features. Instead, it generates a cyberpunk-themed swap confirmation page, optionally embeds a QR code, provides wallet deeplinks for MetaMask/OKX/Trust/TokenPocket, detects whether a browser has an injected wallet, and on user action sends a precomputed Ethereum transaction using eth_sendTransaction. Multi-wallet support and zero-custody wallet signing are consistent with the description, and swap-related behavior is adjacent, but the primary implemented capability in this chunk is UI/page generation and wallet transaction submission for Ethereum swap execution, not the broader trading/Hyperliquid/risk-control functionality claimed. That is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 该代码块的核心用途与声明的一部分相符：它确实围绕 DEX token swap 展开，并支持生成供钱包签名的交易数据，符合“零托管、私钥不离开钱包”的方向。但声明描述的是一个更完整、更广泛的交易技能，覆盖限价单、永续合约、Hyperliquid、仓位管理、资金费率、风控确认、余额预检、订单修改等高级能力；而代码只实现了 swap 报价/路由、构建交易、导出支付链接、生成 HTML/二维码页面、gas 和 token 查询。也就是说，声明显著夸大了实际能力范围。虽然代码没有出现明显危险的未声明外部资源访问，但其实际功能集与声明的主能力集合存在实质性不一致，因此应判定为 mismatch。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a broad trading skill covering swap execution plus advanced order types and derivatives workflows. The supplied code only wraps the 0x allowance-holder swap API to fetch price/quote data and transaction parameters for token swaps on Ethereum. It is consistent with a narrow swap-quote client, but materially does not implement the many advertised v2 features: no Hyperliquid integration, no limit-order book logic, no perpetual contract handling, no position/risk/funding functions, no wallet-specific integration, and no explicit zero-custody signing mechanism beyond returning tx fields. While returning quote transaction data is compatible with a swap skill, the actual behavior is much narrower than the declared purpose, so this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document states that automatic trade execution was removed, but another section still describes a 2-second countdown that automatically triggers eth_sendTransaction in wallet browsers. In a trading context, contradictory guidance around auto-submission is high risk because implementers or downstream agents may preserve or recreate a flow that causes transaction prompts without clear, informed user initiation.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documented 'one-time approval' model establishes persistent delegated trading authority, allowing the agent to place, modify, and cancel trades later without fresh per-action user consent. In a financial skill, this is highly dangerous because any prompt injection, account compromise, or model mistake can convert standing authority into unauthorized market activity on the user's account.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The risk workflow explicitly permits automatic execution of 'small' trades followed only by after-the-fact notification, meaning financial actions can occur without contemporaneous user approval. Even small autonomous trades are unsafe in aggregate and can be abused repeatedly, especially when combined with broad triggers and delegated credentials.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The installer explicitly encourages execution via curl ... | bash, which causes users to run remotely fetched code without an opportunity to inspect, pin, or verify it first. If the distribution channel, hosting location, or network path is compromised, arbitrary shell commands would execute immediately in the user's environment.
Content: Scanner excerpt · install.sh (reported line 3)May include surrounding context.
sh
#!/bin/bash # Web3 Trader Skill Installer # Usage: curl -fsSL install.sh | bash set -e

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The | bash pattern is dangerous because it turns a transport operation into immediate code execution, eliminating review and increasing the blast radius of any compromise. In a web3 trading skill, this is especially sensitive because the environment may hold wallet tooling, API keys, and trading-related configuration that an attacker could abuse.
Content: Scanner excerpt · install.sh (reported line 3)May include surrounding context.
sh
#!/bin/bash # Web3 Trader Skill Installer # Usage: curl -fsSL install.sh | bash set -e

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: Advertising 'auto-execute in wallet dApp browser (2s countdown → direct signature popup)' describes a workflow that nudges or accelerates users into transaction signing with minimal friction. In a financial trading skill, that pattern is dangerous because it reduces meaningful review time, increases the chance of mistaken or manipulated trades, and can be abused if paired with deceptive UI or altered transaction details.
Content: Scanner excerpt · README.md (reported line 14)May include surrounding context.
md
- 💱 Real-time DEX quotes and optimal routing via Antalpha AI Aggregator - 🌐 Cyberpunk-style swap pages (Matrix rain animation + scanline effects) - 📱 4 major wallets: MetaMask, OKX Web3, Trust Wallet, TokenPocket - ⚡ Auto-execute in wallet dApp browser (2s countdown → direct signature popup) - 📷 QR code generation with cyberpunk theme (cyan dots on dark background) - 🔒 Zero custody — private keys never leave the user's wallet - 🤖 MCP remote mode — one `swap-full` call does quote + page hosting

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README promotes a remote MCP flow that performs quote generation, page hosting, and QR/deeplink delivery via a third-party server, but it does not clearly disclose that trade parameters and the taker wallet address may be sent to external infrastructure. In a trading skill, this omission is security-relevant because users may incorrectly infer that 'zero custody' also means minimal data exposure, when in reality transaction metadata can be collected, logged, correlated, or used for profiling and trade surveillance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The Security section strongly emphasizes zero custody and no private-key handling, but it omits that hosted preview pages, QR links, wallet deeplinks, and remote quote/page generation still expose sensitive transaction metadata to third-party infrastructure. In a Web3 trading context, this is dangerous because users may over-trust the skill's privacy properties and disclose trading intent, wallet identity, and behavioral patterns that can be logged or correlated across sessions.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · README.md (reported line 134)May include surrounding context.
md
### v1.0.4 (2026-03-28) - **[P0]** Fix `examples/` and `tests/` using wrong parameter names (`wallet_address`/`slippage` → `taker`) - **[P0]** Fix XSS vulnerability in `swap_page_gen.py` — all user-controlled data now escaped via `html.escape()` - **[P0]** Remove auto-execute in dApp browser — users must explicitly click to confirm swap - **[P1]** Add `timeout=30s` to all HTTP requests to prevent infinite hangs - **[P1]** Preserve exception info in `get_gas_info()` error handling - **[P1]** Add error handling for file write in `cmd_swap_page`

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · scripts/swap_page_gen.py (reported line 317)May include surrounding context.
python
### v1.0.4 (2026-03-28) - **[P0]** Fix `examples/` and `tests/` using wrong parameter names (`wallet_address`/`slippage` → `taker`) - **[P0]** Fix XSS vulnerability in `swap_page_gen.py` — all user-controlled data now escaped via `html.escape()` - **[P0]** Remove auto-execute in dApp browser — users must explicitly click to confirm swap - **[P1]** Add `timeout=30s` to all HTTP requests to prevent infinite hangs - **[P1]** Preserve exception info in `get_gas_info()` error handling - **[P1]** Add error handling for file write in `cmd_swap_page`

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · README.md (reported line 162)May include surrounding context.
md
### v1.0.0 (2026-03-27) - Cyberpunk swap pages (Matrix rain + scanline effects) - 4 wallet support: MetaMask, OKX Web3, Trust Wallet, TokenPocket - Auto-execute in wallet dApp browser (2s countdown) - QR code generation (cyan on dark theme) - Full CLI toolchain (price/route/build-tx/export/swap-page/gas/tokens)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares broad capabilities via metadata and documented workflows (network access, file writes, shell/Python execution) but does not define an explicit permission or allowed-tools scope. In an agent setting, missing tool scoping weakens least-privilege controls and makes it easier for trading-related prompts or malicious prompt injection to trigger filesystem, network, or shell actions beyond what is strictly required.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation scope is extremely broad and covers many ordinary trading-related words, increasing the chance the skill is invoked in contexts where the user did not intend to authorize trading assistance. For a finance skill with networked trading and wallet-related actions, overbroad triggering materially raises the risk of inappropriate tool use or premature progression toward transaction flows.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The security model claims the hosted page has 'no backend communication' in a way that can falsely reassure users, yet the same page is documented to invoke wallet RPC methods for chain switching and transaction submission. Misstating the trust and interaction model is dangerous in a financial skill because users may underestimate that opening the page can trigger privileged wallet prompts and on-chain actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs use of HL_PRIVATE_KEY and account-address environment variables for automated trading without a strong warning that these are sensitive credentials granting ongoing delegated trading authority. In an agent environment, encouraging automatic retrieval of such secrets increases the blast radius of prompt injection, host compromise, or accidental cross-skill access.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · install.sh (reported line 40)May include surrounding context.
sh
pip3 install -r requirements.txt --quiet # Set permissions chmod 600 "$CONFIG_DIR/config.yaml" 2>/dev/null || true echo echo "✅ Installation complete!"

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/SECURITY.md (reported line 45)May include surrounding context.
zeroex: "YOUR_KEY_HERE" # Keep this file private!

text
- Set file permissions: `chmod 600 ~/.web3-trader/config.yaml` - Never commit config.yaml to git - Consider using environment variables in production

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instructions direct operators to upload a generated swap page containing trade context, wallet address, and transaction flow to a public third-party file host unrelated to the core trading function. In a Web3 trading skill, this expands data exposure beyond the declared wallet/DEX scope and can leak sensitive trade metadata or enable tampering/phishing if the hosted page is later shared with users.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation introduces an unnecessary capability to send trade-related output to an external anonymous hosting service, which is not justified by the skill's stated functionality. Because this skill operates in a financial context, any extra network transfer of generated trading artifacts increases the risk of data leakage, untrusted content delivery, and abuse of the hosted page as a phishing surface.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The reference flow silently uploads a generated swap page to a public hosting service without any warning that trade-related data will leave the local environment. In a crypto trading skill, users are especially sensitive to wallet addresses, intended trades, and signing flows, so undocumented exfiltration to a third party creates privacy and social-engineering risk even if no private key is transmitted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow tells users to click a hosted link and sign a transaction, but it does not warn that signing may irreversibly move funds or that users must verify destination, token amounts, chain, and spender/contract details in their wallet. In the context of a DEX trading skill, this omission is especially dangerous because the core action directly triggers blockchain transactions that cannot be reversed once confirmed.
Content: No source excerpt is available for this finding.