trade-with-aiusd

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:44 AM UTC
• Version: 1.0.1

Overview

This appears to be a real AIUSD trading skill, but it needs review because it can move funds and its installers and auth reset flow make broad local changes without enough user control.

Install only if you trust the AIUSD publisher and backend. Use a limited-balance account, protect local tokens, independently verify login domains, require the agent to confirm every trade, withdrawal, stake, unstake, and gas top-up, and avoid running the self-extracting installers in a directory containing important local changes or secrets.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The skill gives mutually inconsistent authentication instructions: one section requires the agent to reply only with fixed browser-auth text, while later sections instruct it to run re-auth commands and report progress. In practice, this can cause unsafe or unpredictable auth handling, including hidden local side effects or user confusion about what actions are being taken on their machine/account.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The documentation instructs the agent to execute local commands such as `npm run reauth`, `npm run login`, or `node scripts/reauth.js`, which goes beyond calling a constrained backend tool and can trigger arbitrary local code execution paths. Because these commands clear local auth state and invoke scripts from the workspace, a compromised or modified repo could use this path to execute unintended code or tamper with credentials.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The installer executes external shell commands (`tar -xzf` and `npm install`) on a bundled opaque payload without any integrity verification, inspection, or sandboxing. This creates a direct path to arbitrary code execution because `npm install` may run package lifecycle scripts and the extracted contents are hidden inside the embedded archive.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The header claims the file contains the complete trading skill package, but the code actually performs installer behavior including deletion, file writes, extraction, and dependency installation. This mismatch is dangerous because it obscures the true execution model and reduces the likelihood that a user will recognize the file as a code-executing installer with supply-chain risk.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The installer comments claim the file 'contains the complete package' and to 'simply run' it, which frames it as a straightforward extractor, but the script also executes npm install on extracted contents. That causes code from package lifecycle scripts and dependencies to run, which is materially more dangerous than mere extraction and can mislead users into executing unreviewed code.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README promotes trading, withdrawals, staking, and swaps through natural-language commands without any prominent warning about irreversible transactions, loss of funds, market risk, slippage, or the possibility of mistaken execution. In an agent skill context, especially one operating through chat interfaces, ambiguous or impulsive commands can directly trigger financial actions, making the omission materially dangerous rather than just a documentation quality issue.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The authentication section states the bot will automatically handle login and the security section says tokens are stored locally, but it does not warn users that local tokens are sensitive credentials whose safety depends on device security. This can mislead users into underestimating the consequences of compromised devices, insecure backups, shared chat environments, or weak filesystem protections.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The re-auth guidance says to clear `~/.mcporter/`, `~/.mcp-hub/`, and other auth caches, but it does not require warning the user that local tokens and session state will be deleted. This creates a consent and transparency problem: users may be logged out, lose cached credentials, or affect other sessions without understanding the consequences.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill enables trading, staking, unstaking, withdrawals, and gas top-ups without requiring explicit user acknowledgement that these are financial actions that may be irreversible. In a finance context, omission of clear risk and confirmation guidance increases the chance of accidental loss, mistaken transfers, or unintended asset conversions.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The installer recursively deletes any existing `aiusd-skill` directory without prompting the user or validating ownership/content. This can cause destructive loss of local data or overwrite a trusted prior installation, especially when run from arbitrary working directories.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The installer silently writes a base64-encoded tarball to disk and extracts it without an up-front warning or a preview of what files will be created. While this is common in installers, it is risky here because the payload is opaque and the user cannot inspect the archive contents before filesystem changes occur.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script unconditionally deletes an existing ./aiusd-skill directory with rm -rf before reinstalling. This can destroy local changes, credentials, configuration, or unrelated data placed in that directory, and it does so without confirmation or backup.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: Running npm install on freshly extracted, unaudited package contents executes dependency resolution and may trigger package lifecycle scripts such as preinstall, install, and postinstall. In a self-extracting installer, this turns archive extraction into immediate code execution from both the bundled package and its dependency tree, substantially increasing risk.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: aiusd-skill-installer.js:58