Crypto Tracker Cn

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:59 PM UTC
• Version: 2.0.0

Overview

This skill mostly provides crypto market tools, but it also includes under-disclosed financial tracking features that can store sensitive local financial data.

Review before installing. The crypto price and market-data features are ordinary, but avoid entering portfolio holdings, purchase prices, transaction descriptions, or budget details unless you are comfortable with plaintext local storage. On shared machines, use a private data directory and restrictive file permissions, or avoid the portfolio and tracking commands.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/crypto.sh:176

Finding

Portfolio Holdings Stored Without Restrictive File Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/crypto.sh:176-182, 197-199
Vulnerability Type: Plaintext sensitive financial data with permissions inherited from the process umask
Risk Level: Medium

Vulnerable Code

python

DATA_DIR = os.path.expanduser("~/.crypto-tracker")
PF = os.path.join(DATA_DIR, "portfolio.json")
if not os.path.isdir(DATA_DIR):
    os.makedirs(DATA_DIR)
if not os.path.isfile(PF):
    with open(PF, "w") as f: json.dump([], f)

portfolio.append({"coin": coin, "amount": amt, "buy_price": price})
with open(PF, "w") as f: json.dump(portfolio, f, indent=2)

Technical Analysis

The portfolio feature stores coin identifiers, holding amounts, and purchase prices in plaintext at ~/.crypto-tracker/portfolio.json. Neither the directory nor the file is created with explicit restrictive permissions.

os.makedirs(DATA_DIR) and open(PF, "w") inherit permissions from the process umask. Under a common umask of 0022, the directory can be created as mode 0755 and the file as mode 0644. On a multi-user system, this can allow other local users to traverse the directory and read the portfolio.

The application does not need to expose this information to other users. Therefore, broadly readable storage exceeds the minimum access required by the portfolio-tracking functionality.

No evidence was found that portfolio amounts or purchase prices are transmitted to CoinGecko or another remote service. The network request used by the portfolio listing feature sends only coin identifiers.

Attack Path

1. A victim invokes crypto.sh portfolio add, causing the script to create ~/.crypto-tracker/portfolio.json.
2. The file receives permissions determined by the victim's current umask.
3. If the resulting permissions permit access by other users, an attacker with a separate local account identifies the victim's home directory.
4. The attacker reads `~/.crypto-tracker/portfolio.j ...[truncated 805 chars]

Remediation

View remediation

Remediation Suggestions

1. Set a restrictive umask before creating any portfolio data:

   bash

   umask 077
   

2. Create the data directory with mode 0700:

   python

   os.makedirs(DATA_DIR, mode=0o700, exist_ok=True)
   os.chmod(DATA_DIR, 0o700)
   

3. Create and maintain the portfolio file with mode 0600:

   python

   import os
   
   fd = os.open(PF, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
   with os.fdopen(fd, "w") as f:
       json.dump(portfolio, f, indent=2)
   os.chmod(PF, 0o600)
   

4. Correct permissions on existing installations, because secure creation logic will not automatically repair an already permissive file.

5. Use atomic writes through a user-private temporary file, followed by os.replace, to avoid partial or corrupted portfolio data.

6. Clearly document that the portfolio is stored locally in plaintext. If confidentiality against disk access is required, provide an optional encrypted storage mechanism backed by an operating-system credential store or a user-supplied encryption key.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/script.sh:5

Finding

Command Arguments Logged in Plaintext Without Explicit Access Controls

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh:5-8, 30
Vulnerability Type: Plaintext logging with permissions inherited from the process umask
Risk Level: Low

Vulnerable Code

bash

DATA_DIR="${CRYPTO_TRACKER_CN_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/crypto-tracker-cn}"
DB="$DATA_DIR/data.log"
mkdir -p "$DATA_DIR"

_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }

Representative callers pass user-controlled command arguments into the log:

bash

cmd_track() {
    echo "  Transaction: $1 Amount: ${2:-0}"
    _log "track" "${1:-}"
}

Technical Analysis

The script creates its data directory and appends command arguments to history.log without setting a restrictive umask or explicit filesystem permissions. The logged value can contain transaction descriptions or other user-entered financial context.

With a common umask of 0022, mkdir -p can create a mode 0755 directory and shell redirection can create history.log as mode 0644. Other local users may consequently be able to inspect the command history.

The logging operation is not necessary for displaying the requested command result, and retaining raw arguments increases the amount of sensitive data stored persistently. The issue is limited to local confidentiality; no network transmission or remote exfiltration was identified.

Attack Path

1. A victim runs a command such as crypto-tracker-cn track DESCRIPTION AMOUNT.
2. The script creates its data directory using permissions inherited from the environment.
3. _log appends the transaction description to history.log.
4. If the resulting directory and file permissions permit access, another local user reads the log.
5. The attacker obtains transaction descriptions, command usage times, and potentially other financial context entered by the victim.

Exploitation requires local filesystem access and permissive resul ...[truncated 509 chars]

Remediation

View remediation

Remediation Suggestions

1. Set umask 077 before creating the data directory or log files.

2. Create the directory with mode 0700 and enforce that mode on existing directories:

   bash

   umask 077
   mkdir -p "$DATA_DIR"
   chmod 700 "$DATA_DIR"
   

3. Create the history file with mode 0600 before appending to it:

   bash

   : >> "$DATA_DIR/history.log"
   chmod 600 "$DATA_DIR/history.log"
   

4. Avoid logging raw transaction descriptions by default. Log only the event type and timestamp, or make detailed logging explicitly opt-in.

5. Add retention controls so that historical financial metadata is deleted after a documented period.

6. Validate that CRYPTO_TRACKER_CN_DIR resolves to a user-controlled, non-symlinked location before writing. Where practical, reject directories owned by another user.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (34)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented purpose is limited to cryptocurrency market tracking, but the detected behavior reportedly extends into personal finance tracking, budgeting, transaction history/export, alerts, and forecasting unrelated to the stated scope. This mismatch is dangerous because users may invoke the skill expecting harmless market lookup while it processes broader financial data, increasing the risk of unintended collection, retention, or exposure of sensitive personal financial information.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/crypto.sh (reported line 21)May include surrounding context.

sh

# Usage: crypto.sh price bitcoin ethereum solana
    ids="${*:-bitcoin,ethereum,solana}"
    ids=$(echo "$ids" | tr ' ' ',')
    curl -s "$GECKO/simple/price?ids=$ids&vs_currencies=usd&include_24hr_change=true&include_market_cap=true" | python3 -c '
import sys, json
d = json.load(sys.stdin)
hdr = "{:<12} {:>12} {:>8} {:>14}".format("Coin","Price","24h","MCap")

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/crypto.sh (reported line 40)May include surrounding context.

sh

market)
    # Global market overview
    curl -s "$GECKO/global" | python3 -c "
import sys, json
d = json.load(sys.stdin)['data']
mcap = d['total_market_cap']['usd']

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/crypto.sh (reported line 61)May include surrounding context.

sh

;;

  trending)
    curl -s "$GECKO/search/trending" | python3 -c "
import sys, json
d = json.load(sys.stdin)
print('🔥 Trending Coins')

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/crypto.sh (reported line 81)May include surrounding context.

sh

;;

  fear)
    curl -s "$FNG/" | python3 -c "
import sys, json
d = json.load(sys.stdin)['data'][0]
val = int(d['value'])

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/crypto.sh (reported line 98)May include surrounding context.

sh

;;

  defi)
    curl -s "$LLAMA/protocols" | python3 -c "
import sys, json
protocols = json.load(sys.stdin)
protocols.sort(key=lambda x: x.get('tvl', 0), reverse=True)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/crypto.sh (reported line 115)May include surrounding context.

sh

;;

  memes)
    curl -s "$GECKO/coins/markets?vs_currency=usd&category=meme-token&order=volume_desc&per_page=15&page=1" | python3 -c "
import sys, json
coins = json.load(sys.stdin)
print('🐕 Top Meme Coins by Volume')

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/crypto.sh (reported line 138)May include surrounding context.

sh

info)
    # Detailed info on a specific coin
    coin="${1:-bitcoin}"
    curl -s "$GECKO/coins/$coin" | python3 -c "
import sys, json
d = json.load(sys.stdin)
name = d.get('name', '?')

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script's behavior materially diverges from the advertised skill purpose: instead of tracking cryptocurrency markets, it implements a generic personal-finance and transaction logger. This kind of scope mismatch is dangerous because users may invoke the skill expecting market data while unknowingly exposing personal financial details to a different local workflow, undermining informed consent and trust boundaries.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises executable behavior with shell, network, environment access, and file-writing capability, but it does not declare any explicit tool scope or permissions boundaries. This is dangerous because an agent or reviewer cannot tell what operations are intended or allowed, which increases the chance of over-privileged execution, unexpected data access, or command execution beyond the stated crypto-tracking purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill presents core sections such as the quick reference, command list headings, tips, and recommendations in Chinese, and the skill name suffix '-cn' reinforces a locale-specific experience. There is no explicit opt-in, language selection, or justification that this skill is intended only for Chinese-speaking users, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crypto.sh (reported line 8)May include surrounding context.

sh

set -euo pipefail

GECKO="https://api.coingecko.com/api/v3"
LLAMA="https://api.llama.fi"
FNG="https://api.alternative.me/fng"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crypto.sh (reported line 293)May include surrounding context.

sh

set -euo pipefail

GECKO="https://api.coingecko.com/api/v3"
LLAMA="https://api.llama.fi"
FNG="https://api.alternative.me/fng"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crypto.sh (reported line 327)May include surrounding context.

sh

set -euo pipefail

GECKO="https://api.coingecko.com/api/v3"
LLAMA="https://api.llama.fi"
FNG="https://api.alternative.me/fng"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crypto.sh (reported line 461)May include surrounding context.

sh

set -euo pipefail

GECKO="https://api.coingecko.com/api/v3"
LLAMA="https://api.llama.fi"
FNG="https://api.alternative.me/fng"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crypto.sh (reported line 539)May include surrounding context.

sh

set -euo pipefail

GECKO="https://api.coingecko.com/api/v3"
LLAMA="https://api.llama.fi"
FNG="https://api.alternative.me/fng"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crypto.sh (reported line 10)May include surrounding context.

sh

GECKO="https://api.coingecko.com/api/v3"
LLAMA="https://api.llama.fi"
FNG="https://api.alternative.me/fng"

cmd="${1:-help}"
shift 2>/dev/null || true

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill claims to track crypto markets, but this section adds persistent portfolio storage and management in ~/.crypto-tracker/portfolio.json. Persisting user financial holdings broadens the data sensitivity and privacy exposure beyond simple market lookup, especially on shared systems or if other tooling later reads the file.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The code automatically creates a local data directory and portfolio file without prompting the user, creating persistent storage of potentially sensitive financial data. In the context of a market-tracking skill, silent local retention is a privacy and transparency issue even though it is not remote exfiltration.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 78% confidence

Finding

This request transmits the user's portfolio coin list to a third-party API. In context, portfolio contents can reveal investment interests or holdings patterns, so external transmission of data derived from locally stored financial information is more sensitive than basic market lookups.

Content

Scanner excerpt · scripts/crypto.sh (reported line 212)May include surrounding context.

sh

coins = list(set(p["coin"].lower() for p in portfolio))
    ids = ",".join(coins)
    try:
        url = "https://api.coingecko.com/api/v3/simple/price?ids={}&vs_currencies=usd".format(ids)
        data = json.loads(urlopen(url).read().decode())
    except:
        data = {}

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This section introduces persistent alert management, which is broader functionality than the stated market-tracking description and stores user-defined monitoring rules on disk. While not directly exploitable on its own, it increases hidden state and user-data retention in a way users may not expect from the manifest.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The compare command requires input via Chinese-only error messages, and other commands also default to Chinese-language content. This imposes a specific language/locale on users without offering a choice or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The learn command defaults to Chinese terms and returns descriptions primarily in Chinese, with no mechanism for users to select their preferred language. Under the policy, forcing a locale-specific experience without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The RSI command emits Chinese-language signals, advice, and risk disclosures, and the MA command does the same pattern elsewhere in the file. Because the skill does not offer a language choice, it effectively enforces a specific locale for user-facing guidance.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crypto.sh (reported line 689)May include surrounding context.

sh

# Try etherscan-compatible free API first (no key needed for basic)
apis = [
    ("https://api.etherscan.io/api?module=gastracker&action=gasoracle", "etherscan"),
    ("https://gas.api.infura.io/v3/gas/feeHistory?chain=ethereum&blockCount=1", "infura"),
]

Static analysis

No suspicious patterns detected.