trade-agent

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:44 AM UTC
• Version: 1.0.1

Overview

This AIUSD trading skill matches its stated purpose, but it needs review because it can move funds and its installers and re-authentication flow perform sensitive actions without clear confirmation gates.

Install only after reviewing the unpacked package and deciding you trust AIUSD and its npm dependencies. Require explicit confirmation before trades, staking, withdrawals, gas top-ups, or re-login, verify amounts, assets, chains, and wallet addresses, and be aware that the installers may delete a prior aiusd-skill folder and run npm lifecycle scripts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The skill gives one set of instructions saying re-authentication responses must be limited to a very specific user-facing message, but later tells the agent to run re-auth commands and announce progress. This conflict can cause inconsistent behavior, including triggering credential-reset actions without clear user consent or providing misleading status messaging during authentication recovery.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The installer automatically executes external commands (`tar -xzf` and `npm install`) on embedded package contents without any validation, review step, or sandboxing. This can lead to arbitrary code execution through install scripts, malicious dependencies, or tampered package contents as soon as the installer is run.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The header claims the file contains the complete skill package and can simply be run, but actual installation depends on system `tar` and then executes `npm install`, which may fetch and run additional unreviewed code. That mismatch increases social-engineering risk by making the installer appear self-contained and safer than it is.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The installer runs `npm install` on extracted, untrusted package contents, which can execute `preinstall`, `install`, and `postinstall` hooks from the package and its dependencies. That gives the archive author code execution on the user's machine during installation, exceeding the stated behavior of simple extraction.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README promotes high-risk financial actions such as trading, staking, and withdrawals through casual chat commands but does not warn users that these operations may be irreversible, market-exposed, or capable of causing permanent asset loss. In a conversational agent context, this omission is more dangerous because users may treat natural-language execution as low-risk and act without understanding confirmation, slippage, custody, or withdrawal consequences.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The authentication section states that the bot will 'automatically handle authentication' and later references AIUSD services, but it does not clearly disclose what account, wallet, or token data is transmitted to external servers during login and operation. For a finance-related skill handling balances and trades, weak disclosure can mislead users about trust boundaries and expose sensitive financial metadata or credentials to third-party infrastructure without informed consent.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The documented re-auth flow includes clearing cache directories and token files, which is a destructive action affecting authentication state, but it does not require warning the user or obtaining consent first. An agent following this guidance could erase local credentials or session state unexpectedly, causing account disruption or forcing unintended re-login flows.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The installer deletes any existing `aiusd-skill` directory under the current working directory with `fs.rmSync(..., { recursive: true })` and recreates it without prompting the user. This can cause unintended data loss or destructive overwrite if the directory already contains user data or prior work.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The installer performs archive extraction and dependency installation immediately, with no explicit consent gate between unpacking and executing package lifecycle actions. In a skill installer context, that increases the danger because users are likely to run it directly and may not expect code execution during installation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script unconditionally performs `rm -rf "$SKILL_DIR"` when the directory exists, with no confirmation or backup. While the target path is fixed relative to the current directory, this still enables silent data loss and makes the installer more dangerous to run in unintended locations or automated contexts.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Running `npm install` without clearly disclosing lifecycle hook execution causes the installer to execute package-defined scripts and arbitrary dependency install hooks implicitly. In a self-extracting archive, this is especially dangerous because the extracted package contents are opaque until after execution, so users may believe they are only unpacking files.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

This skill calls the AIUSD backend via MCP. Auth is resolved in order: env `MCP_HUB_TOKEN`, mcporter OAuth, or local `~/.mcp-hub/token.json`. Ensure a valid Bearer token is available before calling.

## ⚠️ Agent Output Guidelines

**CRITICAL - ABSOLUTELY FORBIDDEN PHRASES**:
Agents must NEVER use these words or phrases when responding to users:

• Confidence: 89% confidence
• Finding: The skill contains strong prompt-level instructions that attempt to control how the agent speaks and behaves, including absolute bans on certain terms and mandatory operational sequencing. In a security-sensitive trading skill, this kind of embedded instruction can override safer default behaviors, suppress transparency, and increase the chance that the agent follows adversarial or policy-conflicting directions from untrusted skill content.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: aiusd-skill-installer.js:58