Phemex Trade

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:56 PM UTC
• Version: 1.2.0

Overview

This Phemex trading skill is openly trading-focused, but it needs review because it combines real financial authority with a mutable global CLI install and persistent plaintext exchange credentials.

Review this before installing. Prefer a pinned and audited CLI version, start on testnet, use a dedicated least-privileged Phemex API key, avoid granting withdrawal or unnecessary trading permissions, and prefer an OS secret store or ephemeral environment variables. If you use ~/.phemexrc, restrict it to the current user and manually confirm every action that can trade, cancel, change leverage, switch modes, or move funds.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:43
• Finding: Unpinned Global Installation of a Security-Sensitive Trading Dependency## Vulnerability Details **File Location**: `SKILL.md`, line 43 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: High ### Vulnerable Code ```bash npm install -g phemex-trade-mcp@latest ``` ### Technical Analysis The skill instructs users to install the mutable `latest` release of `phemex-trade-mcp` globally. No exact version, lockfile, package integrity hash, or other reproducible verification mechanism is specified. The installed package is especially security-sensitive because `phemex-cli` subsequently receives Phemex API credentials and is authorized to place orders, change leverage, cancel orders, and transfer funds. A Node.js package may also execute package-controlled lifecycle scripts during installation. Because the dependency's source code is not included in the audited project, its installation behavior and credential handling cannot be verified here. This creates a supply-chain trust boundary in which a compromised maintainer account, registry compromise, malicious future release, or transferred package ownership could cause newly installed copies of the skill dependency to execute attacker-controlled code. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, or its publication process. 2. The attacker publishes a malicious release under the mutable `latest` tag. 3. A user follows the documented command and globally installs that release. 4. Malicious code executes through an npm lifecycle script or when `phemex-cli` is invoked. 5. The package reads Phemex credentials from environment variables or `~/.phemexrc`. 6. The attacker exfiltrates the credentials, performs unauthorized trades, or executes code with the privileges of the installing user. ### Impact Assessment Successful exploitation could provide code execution under the account running npm, access to environment variables and user-readable files, and theft of Phemex API credentia ...[truncated 341 chars]
• Remediation: ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed version, such as `phemex-trade-mcp@1.2.0`. 2. Record and verify package integrity using a lockfile and registry-provided integrity hashes. 3. Prefer a project-local installation over a global installation to reduce exposure and improve reproducibility. 4. Audit and vendor the dependency implementation where practical, particularly installation scripts, credential access, network destinations, and order-validation logic. 5. Disable lifecycle scripts during installation when they are unnecessary, for example with `npm install --ignore-scripts`, after verifying that the package remains functional. 6. Establish a controlled upgrade process that reviews release diffs before changing the pinned version. 7. Run the CLI with a dedicated, least-privileged API key that cannot withdraw funds and has only the permissions required for the requested operation.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:329
• Finding: Production Trading Credentials Stored in a Plaintext Configuration File## Vulnerability Details **File Location**: `SKILL.md`, lines 329-338 **Vulnerability Type**: Plaintext storage of sensitive authentication credentials **Risk Level**: Medium ### Vulnerable Code ```bash Create `~/.phemexrc` — credentials persist across sessions without exporting env vars: # ~/.phemexrc PHEMEX_API_KEY=your-api-key PHEMEX_API_SECRET=your-api-secret PHEMEX_API_URL=https://api.phemex.com # Optional: max order value limit (USD) PHEMEX_MAX_ORDER_VALUE=1000 ``` ### Technical Analysis The recommended configuration stores a long-lived Phemex API key and secret in a plaintext file under the user's home directory. The instructions do not require restrictive file permissions, validate ownership, recommend an operating-system secret store, or instruct users to limit the API key's privileges. Home-directory configuration files can be exposed to other local accounts when permissions are weak, endpoint malware, development tools, support bundles, home-directory backups, or accidental archival and synchronization. The explicit use of the production API endpoint increases the potential financial consequences of disclosure. `PHEMEX_MAX_ORDER_VALUE` may reduce accidental order size if correctly enforced by the external CLI, but it is stored alongside the credentials and cannot be considered a security boundary against an attacker who obtains the secret or can alter local configuration. ### Attack Path 1. A user follows the setup instructions and writes an API key and secret to `~/.phemexrc`. 2. The file is created with overly broad permissions, copied into an insecure backup, synchronized to another location, or read by malware running as the user. 3. An attacker obtains the API key and secret. 4. The attacker authenticates directly to the Phemex API or uses the documented CLI. 5. The attacker performs any account operation permitted by the API key, potentially including account inspection, unauthorized orders ...[truncated 580 chars]
• Remediation: ## Remediation Suggestions 1. Prefer an operating-system credential manager, encrypted secret store, or dedicated secrets-management service instead of a plaintext configuration file. 2. If file-based storage is unavoidable, create the file with restrictive permissions and document the requirement explicitly: ```bash install -m 600 /dev/null ~/.phemexrc chmod 600 ~/.phemexrc ``` 3. Have the CLI reject or prominently warn about configuration files not owned by the current user or accessible by group and other users. 4. Use a dedicated Phemex API key with the minimum required read or trade permissions and disable withdrawal rights. 5. Separate production and testnet credentials and make testnet the clearly recommended default. 6. Rotate credentials immediately after suspected exposure and provide documented revocation procedures. 7. Exclude `.phemexrc` from backups, synchronization systems, support archives, and source-control repositories where appropriate. 8. Treat order-value limits as defense in depth only; enforce limits server-side or through restricted exchange permissions whenever possible.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill description is very broad and can match nearly any Phemex or exchange-related request, including high-risk trading actions. In an agent-routing context, this increases the chance the skill is invoked when the user only asked for general market information, which can expose trading-capable tools and sensitive account operations unnecessarily.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option 1: Config file (recommended)

Create `~/.phemexrc` — credentials persist across sessions without exporting env vars:

```bash
# ~/.phemexrc

• Confidence: 94% confidence
• Finding: The skill recommends storing API credentials persistently in ~/.phemexrc, which creates a long-lived secret on disk that may be readable by other local processes, accidentally included in backups, or exposed through other tools with filesystem access. Because these credentials authorize balance queries, transfers, leverage changes, and order placement, compromise can directly lead to financial loss.

Static analysis

No suspicious patterns detected.