Security audit

bitopro-spot

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a coherent crypto trading skill, but it exposes live trading, order cancellation, and withdrawals with under-scoped confirmations and insufficient risk warnings.

Review this carefully before installing. Use only scoped exchange API keys, preferably with withdrawals disabled, and test in sandbox or dry-run mode first. Do not allow the skill to place trades, cancel orders, or withdraw funds unless it requires exact, fresh confirmation of the asset, pair, amount, destination, and action.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: Using the everyday phrase '繼續' as a session-authorized trading trigger is dangerously ambiguous because it can appear in normal conversation and be misinterpreted as approval to place a live order. In a trading skill with private order-placement capability, this raises the risk of unintended execution from vague user utterances, context bleed, or prompt injection via surrounding dialogue.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger phrase '執行下一步' is underspecified and can authorize a state-changing trade without clearly binding the request to a specific session, instrument, amount, or strategy action. In a spot-trading skill, this creates a real risk of accidental or adversarial invocation of order placement when multiple sessions, retries, or stale pending steps exist.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: These sections document order-creation endpoints that can place live buy/sell orders, including market and stop-limit orders, but provide no explicit user warning that invoking them can immediately commit funds and create real financial exposure. In a trading skill that may be called by other strategy skills, lack of prominent confirmation/impact language increases the risk of accidental or automated destructive actions.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The cancellation endpoints can revoke one, many, or all open orders across pairs, yet the documentation does not clearly warn users that these are account-affecting actions that may disrupt active strategies or remove protective orders. In a session-aware trading integration, silent exposure of bulk cancel operations raises the chance of accidental portfolio-impacting behavior.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The withdrawal endpoint moves assets out of the exchange account to external destinations, which is often irreversible once submitted, but the documentation omits a strong warning about that risk. Because this skill supports authenticated private actions, exposing withdrawals without conspicuous danger notices or confirmation expectations materially increases the likelihood of account-draining mistakes or abuse.

Static analysis

No suspicious patterns detected.