Security audit

Mt5 Trading Assistant Pro

Security checks for vulnerabilities and agentic risk

Overview

This MT5 trading skill is purpose-aligned but needs review because it asks for trading-capable credentials, stores them locally without defined protections, and uses broad natural-language trading controls.

Review this carefully before installing. Use it only with a demo or low-risk account unless you are comfortable giving the agent trading-capable MT5 credentials, and confirm where credentials are stored, how they are protected, how to delete them, and exactly what prompts can execute or modify trades.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:89
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:273
Finding: Trading-Capable Credentials Stored Without Defined Protection Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Ssd 2

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The changelog explicitly states the package was modified to reduce security flags by renaming sensitive concepts while maintaining the same functionality. This is a strong indicator of deliberate scanner evasion and concealment of potentially risky credential-handling behavior, especially in a trading automation skill that includes local credential storage and autonomous market actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Saying users can load indicators '按指标名称或关键词即可加载' is ambiguous because it does not state which exact phrases activate the skill or when mention of an indicator name should not trigger it. The lack of explicit trigger constraints makes activation behavior unclear and potentially too broad.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The instruction '只需说"加载 [关键词]"即可' defines activation in a very broad natural-language form without any scope limits, exclusion conditions, or negative examples. Because many listed keywords are short or generic terms such as 'volume', '波动', or '高低点', this could cause unintended invocation from normal conversation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The example invocations use broad everyday phrases like 'What opportunities exist now?' and 'Give me something simple,' without clear boundaries between informational analysis and executable trading behavior. In this context, the ambiguity is dangerous because the skill advertises autonomous scanning, strategy generation, and trade automation, so loosely phrased inputs may be interpreted as consent to perform higher-risk actions than the user intended.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly invites unconstrained natural-language control with 'Speak naturally — no special commands needed,' which widens the trigger surface for a high-impact domain: financial trading. In a trading assistant that can connect to an MT5 terminal and perform trade-related actions, ambiguous activation increases the chance of unintended order placement, position changes, or risky workflow execution from casual phrasing or prompt confusion.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The skill content and user-facing instructions are presented only in Chinese, which may impose a language constraint on users without opt-in or justification. Under the policy, forced language or locale behavior should either offer a choice or clearly document why the limitation exists.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.