ClawHub
Back to skill

Security audit

Phemex Trade

Security checks for vulnerabilities and agentic risk

Overview

This Phemex trading skill is openly trading-focused, but it needs review because it combines real financial authority with a mutable global CLI install and persistent plaintext exchange credentials.

Review this before installing. Prefer a pinned and audited CLI version, start on testnet, use a dedicated least-privileged Phemex API key, avoid granting withdrawal or unnecessary trading permissions, and prefer an OS secret store or ephemeral environment variables. If you use ~/.phemexrc, restrict it to the current user and manually confirm every action that can trade, cancel, change leverage, switch modes, or move funds.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:43
Finding

Unpinned Global Installation of a Security-Sensitive Trading Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 43
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: High

Vulnerable Code

bash
npm install -g phemex-trade-mcp@latest

Technical Analysis

The skill instructs users to install the mutable latest release of phemex-trade-mcp globally. No exact version, lockfile, package integrity hash, or other reproducible verification mechanism is specified.

The installed package is especially security-sensitive because phemex-cli subsequently receives Phemex API credentials and is authorized to place orders, change leverage, cancel orders, and transfer funds. A Node.js package may also execute package-controlled lifecycle scripts during installation. Because the dependency's source code is not included in the audited project, its installation behavior and credential handling cannot be verified here.

This creates a supply-chain trust boundary in which a compromised maintainer account, registry compromise, malicious future release, or transferred package ownership could cause newly installed copies of the skill dependency to execute attacker-controlled code.

Attack Path

  1. An attacker compromises the npm package, its maintainer account, or its publication process.
  2. The attacker publishes a malicious release under the mutable latest tag.
  3. A user follows the documented command and globally installs that release.
  4. Malicious code executes through an npm lifecycle script or when phemex-cli is invoked.
  5. The package reads Phemex credentials from environment variables or ~/.phemexrc.
  6. The attacker exfiltrates the credentials, performs unauthorized trades, or executes code with the privileges of the installing user.

Impact Assessment

Successful exploitation could provide code execution under the account running npm, access to environment variables and user-readable files, and theft of Phemex API credentia ...[truncated 341 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with an exact, reviewed version, such as phemex-trade-mcp@1.2.0.
  2. Record and verify package integrity using a lockfile and registry-provided integrity hashes.
  3. Prefer a project-local installation over a global installation to reduce exposure and improve reproducibility.
  4. Audit and vendor the dependency implementation where practical, particularly installation scripts, credential access, network destinations, and order-validation logic.
  5. Disable lifecycle scripts during installation when they are unnecessary, for example with npm install --ignore-scripts, after verifying that the package remains functional.
  6. Establish a controlled upgrade process that reviews release diffs before changing the pinned version.
  7. Run the CLI with a dedicated, least-privileged API key that cannot withdraw funds and has only the permissions required for the requested operation.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:329
Finding

Production Trading Credentials Stored in a Plaintext Configuration File

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 329-338
Vulnerability Type: Plaintext storage of sensitive authentication credentials
Risk Level: Medium

Vulnerable Code

bash
Create `~/.phemexrc` — credentials persist across sessions without exporting env vars:

# ~/.phemexrc
PHEMEX_API_KEY=your-api-key
PHEMEX_API_SECRET=your-api-secret
PHEMEX_API_URL=https://api.phemex.com

# Optional: max order value limit (USD)
PHEMEX_MAX_ORDER_VALUE=1000

Technical Analysis

The recommended configuration stores a long-lived Phemex API key and secret in a plaintext file under the user's home directory. The instructions do not require restrictive file permissions, validate ownership, recommend an operating-system secret store, or instruct users to limit the API key's privileges.

Home-directory configuration files can be exposed to other local accounts when permissions are weak, endpoint malware, development tools, support bundles, home-directory backups, or accidental archival and synchronization. The explicit use of the production API endpoint increases the potential financial consequences of disclosure.

PHEMEX_MAX_ORDER_VALUE may reduce accidental order size if correctly enforced by the external CLI, but it is stored alongside the credentials and cannot be considered a security boundary against an attacker who obtains the secret or can alter local configuration.

Attack Path

  1. A user follows the setup instructions and writes an API key and secret to ~/.phemexrc.
  2. The file is created with overly broad permissions, copied into an insecure backup, synchronized to another location, or read by malware running as the user.
  3. An attacker obtains the API key and secret.
  4. The attacker authenticates directly to the Phemex API or uses the documented CLI.
  5. The attacker performs any account operation permitted by the API key, potentially including account inspection, unauthorized orders ...[truncated 580 chars]
Remediation
View remediation

Remediation Suggestions

  1. Prefer an operating-system credential manager, encrypted secret store, or dedicated secrets-management service instead of a plaintext configuration file.

  2. If file-based storage is unavoidable, create the file with restrictive permissions and document the requirement explicitly:

    bash
    install -m 600 /dev/null ~/.phemexrc
chmod 600 ~/.phemexrc

  3. Have the CLI reject or prominently warn about configuration files not owned by the current user or accessible by group and other users.

  4. Use a dedicated Phemex API key with the minimum required read or trade permissions and disable withdrawal rights.

  5. Separate production and testnet credentials and make testnet the clearly recommended default.

  6. Rotate credentials immediately after suspected exposure and provide documented revocation procedures.

  7. Exclude .phemexrc from backups, synchronization systems, support archives, and source-control repositories where appropriate.

  8. Treat order-value limits as defense in depth only; enforce limits server-side or through restricted exchange permissions whenever possible.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description is very broad and can match nearly any Phemex or exchange-related request, including high-risk trading actions. In an agent-routing context, this increases the chance the skill is invoked when the user only asked for general market information, which can expose trading-capable tools and sensitive account operations unnecessarily.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

The skill recommends storing API credentials persistently in ~/.phemexrc, which creates a long-lived secret on disk that may be readable by other local processes, accidentally included in backups, or exposed through other tools with filesystem access. Because these credentials authorize balance queries, transfers, leverage changes, and order placement, compromise can directly lead to financial loss.

Content

Scanner excerpt · SKILL.md (reported line 329)May include surrounding context.

Option 1: Config file (recommended)

Create ~/.phemexrc — credentials persist across sessions without exporting env vars:

bash
# ~/.phemexrc

Static analysis

No suspicious patterns detected.