Fs Worldcup Knockout

• Outcome: Review
• Latest audit: Jul 13, 2026 · 9:54 AM UTC
• Version: 0.1.5

Overview

This skill does what it says, but it handles trading-account credentials in ways users should review before installing.

Install only if you are comfortable with a skill that logs in to propSPACE, creates or uses an account, stores a bearer token locally, and can place play-money competition trades when --live is used. Set a strong FS_PASSWORD instead of the default, protect or delete the .auth token file after use, avoid pasting GitHub tokens into clone URLs, and do not run the Brave enrichment script in shared logs until the API-key prefix print is removed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises and documents capabilities that require environment access, local file read/write, and network communication, yet it declares no explicit permissions. That mismatch weakens sandboxing and review because operators may grant or execute broader capabilities than expected, and the skill also handles credentials, token persistence, and live trading actions that increase the risk of unintended data exposure or unauthorized mutations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose centers on trading propSPACE markets, but the skill also performs external web searches, local persistence of auth tokens and sentiment data, and account creation/login flows. Hidden or underemphasized behaviors of this kind are dangerous because they expand the trust boundary beyond market analysis into credential handling, persistent storage, and third-party data exfiltration channels, making operator consent and review less informed.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The script prints the first several characters of the Brave API key to stdout, which leaks authentication material into logs, terminals, CI output, or shared run histories. Even partial secret disclosure weakens credential confidentiality and can aid correlation, key identification, or social engineering, especially in multi-user or hosted agent environments.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This test brief explicitly instructs the operator to run `python3 main.py --live` and execute real trades against a live engine, then verify resulting positions. Even though the environment is described as play-money, it still changes remote account state and creates positions, and the document does not present a clear safety warning, confirmation gate, or guidance to avoid accidental execution in the wrong environment.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The instructions tell the user to create and export a GitHub PAT and to clone using a URL that embeds the token directly in the command line. This creates unnecessary secret exposure risk because shell history, process listings, logs, screenshots, or copied transcripts may leak the token, and the brief does not warn about secure handling or cleanup.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The client writes a long-lived bearer token to disk in plaintext via token_store with no warning, permission hardening, or secure storage mechanism. If the local filesystem is accessible to another user, process, backup system, or malware, the token can be copied and reused to impersonate the account and perform authenticated trading actions until expiry.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code uses a hardcoded fallback password (`simmer-wc-bot`) when `FS_PASSWORD` is unset, which creates predictable credentials for account creation or login. In this skill's context, the script can auto-signup and persist auth tokens, so a default password makes unauthorized access to the bot account materially easier if the username is known or guessable.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Displaying a prefix of the Brave API key in user-facing output unnecessarily exposes part of a secret to anyone who can view the console or logs. In an agent skill context, output may be persisted or surfaced to operators, making even partial credential leakage more dangerous than in a purely local script.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_fs_worldcup_knockout.py:17

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: FUNCTIONSPACE_HANDOFF.md:27