blave-quant

• Outcome: Review
• Latest audit: Jul 14, 2026 · 5:05 AM UTC
• Version: 1.15.0

Overview

This skill is mostly a disclosed trading/data reference, but it also tells agents to download and run marketplace strategy code locally, which is too broad for automatic trust.

Install only if you are comfortable with a high-authority trading skill. Use dedicated least-privilege exchange API keys, disable withdrawals, enable IP allowlists, and do not run marketplace strategy code on the host or near trading credentials unless you have reviewed it and isolated it in a sandbox.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (87)

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The skill advertises marketplace operations in the reference guide even though the manifest description does not declare marketplace functionality. This scope mismatch can mislead agents or users about what actions are in-bounds, increasing the chance that strategy browsing, purchasing, uploading, or sharing features are invoked without clear review, consent, or policy coverage.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly instructs the agent to attach a developer-controlled affiliate code to every Bitfinex order, creating an undisclosed third-party compensation path tied to user transactions. In a trading skill, this is dangerous because it silently monetizes user activity and can bias agent behavior toward executing trades that benefit the skill author rather than the user.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file is labeled as BitMart spot trading scenarios, but it also documents isolated margin borrowing, margin order placement, and repayment flows. This scope expansion is dangerous because an agent or user relying on a 'spot' skill may unknowingly invoke leveraged trading operations with liquidation and debt risk, which are materially riskier than spot trades.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The document explicitly classifies 'withdraw' as a WRITE intent, but the skill metadata for BitMart spot only declares trading, balance, history, and transfers—not withdrawals. In an agentic trading skill, undocumented asset-withdrawal capability materially expands the action surface from trading loss to direct fund exfiltration, especially if downstream tooling or prompts infer available actions from the reference docs.

Intent-Code Divergence

Low

• Confidence: 87% confidence
• Finding: The skill states that WRITE operations require 'CONFIRM', but the operation flow only details confirmation around orders and not withdrawals, despite withdrawals being listed under WRITE intent. That inconsistency can cause an agent or integrator to apply weaker safeguards to a much higher-risk action, enabling irreversible fund transfers without an explicit dedicated confirmation and verification sequence.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The documentation adds a capability to download third-party strategy source code and execute it locally with python3, which is materially broader than ordinary market-data retrieval or exchange order placement. This creates an implicit remote code execution pathway through marketplace content, allowing arbitrary code from purchased strategies to access local files, credentials, network resources, or trading accounts if an operator follows the instructions.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The file documents submission, private upload, sharing, and retrieval of arbitrary Python source code through the marketplace, expanding the skill into a code-hosting and code-delivery channel beyond its declared trading/data purpose. Even without immediate execution, this enables staged delivery of malicious payloads to other users or downstream automation that may later run the code.

Context-Inappropriate Capability

Critical

• Confidence: 99% confidence
• Finding: These instructions explicitly endorse retrieving Python code from a remote marketplace and executing it locally, which is a direct untrusted-code-execution pattern. In the context of a trading skill that likely has access to API secrets and financial actions, malicious strategy code could steal credentials, place unauthorized trades, exfiltrate data, or pivot into the host environment.

Context-Inappropriate Capability

Critical

• Confidence: 99% confidence
• Finding: The multi-strategy bundle flow instructs splitting untrusted downloaded content into multiple files, moving them into a strategies directory, and running each one, multiplying the attack surface and persistence opportunities. A malicious bundle can hide one harmful payload among several seemingly benign strategies, and the file operations create a pathway for planting attacker-controlled code into operational locations.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The document gives conflicting safety and access-control guidance: it states the queries are all read-only and need no CAPTCHA, then later includes a CAPTCHA-gated broker-branch retrieval flow. This can mislead an agent into treating protected access as unrestricted and automatically attempting CAPTCHA bypass steps, weakening safeguards around access-controlled data collection.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The file explicitly says no CAPTCHA is needed, but shortly afterward states that broker-detail queries require CAPTCHA verification. This contradiction is dangerous because downstream agents may follow the earlier, broader instruction and suppress safety checks when handling a later protected workflow.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly enables authenticated trading across multiple exchanges and requires numerous API keys, but it does not prominently warn that actions may place real orders, move funds, or transmit sensitive account data to third-party services. In a trading skill, this omission materially increases the risk of users unknowingly authorizing live financial actions or exposing privileged credentials.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This reference documents live order placement and cancellation endpoints for Binance Spot without any explicit guardrails, warnings, or requirement to confirm that actions may execute against real funds. In an agent skill context, omission of such safety cues increases the chance that downstream tooling or prompts will invoke destructive actions unintentionally, especially because production base URLs are presented alongside testnet URLs.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The futures section exposes endpoints for leveraged order placement, batch actions, cancellation, leverage changes, margin type changes, and position mode adjustments without warning that these can materially alter risk, liquidation exposure, or account configuration. Given this skill’s broader purpose includes exchange trading automation, the lack of cautionary language and operational safeguards makes accidental or prompt-induced high-impact financial actions more dangerous than in a purely educational reference.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This reference documents live trading, position-closing, leverage, margin, cancel-all, reverse-position, and other destructive endpoints while explicitly defaulting to live trading unless paper trading is requested. In a tool intended for agent use, missing prominent warnings and confirmation requirements materially increases the chance of accidental real-money trades or irreversible account actions, especially because the skill context includes automated exchange trading across multiple venues.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The authentication section instructs loading `BINGX_API_KEY` and `BINGX_SECRET_KEY` from `.env` but gives no guidance on secret handling, least privilege, or avoiding disclosure in logs, prompts, errors, or source control. In an agent skill that may compose requests and surface debugging information, this omission increases the risk of credential leakage and subsequent unauthorized trading or account access.

Missing User Warnings

Medium

• Confidence: 74% confidence
• Finding: The skill provides authenticated request code using API key and secret for private trading actions without adjacent user-facing disclosure about the sensitivity of those credentials or the financial authority they grant. In a high-risk trading context, this increases the chance that users or downstream agents treat credential handling casually, leading to unauthorized trades or account compromise if secrets are mishandled.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: Mandating a developer affiliate code on every order without user opt-in is an undisclosed monetization mechanism embedded in transaction execution instructions. In a trading skill, this is especially concerning because the agent can be steered to perform revenue-generating actions for the author while the user may be unaware of the conflict of interest.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The reference enumerates private endpoints for placing/canceling orders, setting leverage, changing margin mode, and transferring funds, but does not prominently warn that these actions can execute real trades or alter live account state. In a skill explicitly designed for exchange trading, this omission increases the chance that an agent or user invokes dangerous operations without adequate confirmation, dry-run support, or environment separation.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document enumerates many KEYED endpoints that disclose balances, positions, transaction history, sub-account data, and affiliate data to BitMart, but it does not clearly warn users that invoking them transmits sensitive financial/account metadata to a third-party service. In a trading skill context, that omission can lead an agent or user to over-share account intelligence under the mistaken assumption that read-only calls are low risk.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The SIGNED sections document endpoints that can place/cancel/modify orders, change leverage and position mode, and transfer funds, yet they lack an explicit high-visibility warning that these calls can directly alter live assets. In an agent skill, this increases the chance of unintended destructive actions because examples normalize live trading operations without strong guardrails or confirmation requirements.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation includes a ready-to-run authenticated example that submits a live BitMart futures order using credentials loaded from environment variables, but it provides no warning that the call mutates account state or can execute real trades. In a trading skill context, this materially increases the chance of accidental fund loss, especially if users copy/paste the snippet in production with real API keys.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This reference file contains executable examples for live trading, margin borrowing, repayment, transfers, and mass cancellation without any explicit safety guardrails, sandbox/testnet warning, confirmation requirements, or notice that these actions can cause immediate and irreversible financial loss. In an agent-skill context, documentation often gets operationalized directly, so omission of transaction-risk warnings materially increases the chance that an agent or user will perform destructive real-money actions unintentionally.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The portfolio check scenario retrieves and displays detailed wallet balances and USD valuations, which are sensitive financial account data. Without an explicit privacy warning, data-minimization guidance, or masking rules, an agent may expose holdings in logs, chat history, screenshots, or to unintended viewers.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The examples instruct users to load API credentials from environment variables and transmit them in request headers to an external service, but they do not warn about secret handling, scope, logging, or the trust boundary. In a skill that also supports live trading and account actions, this omission increases the chance that users expose production keys or reuse overly privileged credentials without understanding the risk.

VirusTotal

62/62 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.