01-exchange-skill(not official)

• Analyzed: May 12, 2026, 3:24 AM
• Findings: 0
• Version: 1.0.0
• Hash: 439424864c8d0337ce151b8e002529912a10e24ec91d80990845fd8e346c706f
• Source: File reputation
• External report: View on VirusTotal

Overview

No VirusTotal analysis has been recorded yet. File reputation checks will appear here once the artifact hash has been scanned.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

Note

What this means

If copied or executed carelessly, these examples could change positions or move collateral on a real trading account.

Why it was flagged

The skill documents API/SDK calls that can place orders, close positions, deposit, and withdraw funds. These are high-impact financial actions, but they are consistent with the stated trading-development purpose and are accompanied elsewhere by approval and testnet guidance.

Skill content

await nord.placeOrder({ ... }); ... await nord.closeAllPositions(); ... await nord.deposit({ token: 'USDC', amount: 10000.00 }); ... await nord.withdraw({ token: 'USDC', amount: 5000.00 });

Recommendation

Use devnet first, require explicit per-action confirmation, set small limits, and never let an agent execute trading or withdrawal calls unattended.

ASI03: Identity and Privilege Abuse

Note

What this means

A misconfigured or exposed local API could allow unintended signed trading actions.

Why it was flagged

Trading requires a locally configured API that signs transactions using the user's wallet setup. This is disclosed and central to the exchange integration, but it is privileged access.

Skill content

Trading Setup (Requires Local API) ... nord-local-api config ... Start local API ... Local API (signs transactions)

Recommendation

Keep the local API bound to localhost, protect the wallet, use a dedicated low-balance trading wallet, and verify every signed transaction.

ASI04: Agentic Supply Chain Vulnerabilities

Note

What this means

Installing the wrong or compromised package could run untrusted code on the user's machine.

Why it was flagged

The documentation asks users to install external npm packages, including a global CLI/local API package, without pinned versions. This is expected for SDK integration but should be verified.

Skill content

npm install @n1xyz/nord-ts @solana/web3.js ... npm install -g @n1xyz/local-api

Recommendation

Verify package names against official 01.xyz/N1 documentation, prefer pinned versions, and review package provenance before installing.

ASI09: Human-Agent Trust Exploitation

Note

What this means

A user might over-trust the safety wording and allow broader agent access than intended.

Why it was flagged

The skill gives strong safety assurances while also documenting trading through a local signing API. The guidance is safety-oriented, but users should treat these as required procedures rather than technical enforcement.

Skill content

AI cannot spend funds — Impossible without your keys ... Place orders without confirmation — Safety guardrails prevent this ... Every trading action requires explicit human confirmation

Recommendation

Confirm that your agent/tooling actually enforces approval prompts and does not have unattended access to the local API or wallet.