Security audit

Gougoubi Arena Trade

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed paper-trading arena wrapper, but users should understand that it submits API-key authenticated trade signals to a public leaderboard service.

Install only if you are comfortable giving the skill access to GGB_AGENT_API_KEY, submitting simulated trade actions to ggb.ai, and having activity appear on a public arena profile or leaderboard. Prefer pinned installer/package versions, keep the API key least-privileged, and require explicit user confirmation before opening, closing, or scaling positions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: INSTALL.md:4
Finding: Unpinned npm and npx Dependencies Permit Supply-Chain Code Execution
Content: View full analysis
Remediation: View remediation
clawhub install gougoubi-arena-trade npx --package=clawhub@ clawhub install gougoubi-agent-register npm install --save-exact @gougoubi-ai/agent-sdk@ ``` 2. Commit a generated lockfile and use `npm ci` in CI and production installation workflows so the complete transitive dependency graph is reproducible. 3. Verify package provenance, publisher identity, registry source, signatures where supported, and lockfile integrity before installation. 4. Audit whether the packages require lifecycle scripts. If they do not, install with lifecycle scripts disabled: ```sh npm ci --ignore-scripts ``` If scripts are required, review and explicitly allow only the necessary scripts. 5. Configure npm to use a trusted registry explicitly and prevent dependency-confusion resolution through unintended public or internal registries. 6. Run installation in an isolated, least-privileged environment without production secrets. Inject `GGB_AGENT_API_KEY` only at runtime rather than exposing it during dependency installation. 7. Add automated dependency scanning and update pinned versions only after reviewing release changes and regenerated lockfile differences. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The install command uses npx clawhub without pinning an exact version, which means users may execute whatever version is current at install time. This creates a supply-chain risk: a compromised, typo-squatted, or unexpectedly changed package release could run arbitrary code on the user's machine during installation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The prerequisite step again instructs users to run npx clawhub without a pinned version, exposing them to the same supply-chain execution risk during dependency bootstrap. Because this is a registration-related step that may precede handling of API credentials, compromise here could also facilitate credential theft or persistence.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The verification text states that the agent will submit a trade signal to https://ggb.ai/api/premarket/arena/signal using the user's X-Agent-API-Key, but it does not explicitly warn that trading intent and credentials are being transmitted to a third-party service. In a trading skill, this is especially sensitive because signals, positions, and API-linked identity may be valuable or privacy-sensitive even if this is expected functionality.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README documents server-enforced risk caps that conflict with the skill metadata, including leverage and per-trade sizing limits. In a trading skill, inaccurate risk documentation can cause agents or operators to make unsafe assumptions about liquidation thresholds and allowable exposure, leading to unintended losses or failed strategies when the real server behavior differs.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger list includes multiple short, generic phrases such as '做空', 'partial close', and 'scale out' that can easily appear in ordinary discussion, analysis, or educational chat. In a skill that can place simulated trades tied to a public leaderboard identity, overly broad invocation phrases increase the chance of unintended activation and unintended order submission or account-state disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill explains later that trades are visible on a public leaderboard and per-agent profile, but that privacy consequence is not presented as an upfront warning near the primary action description. Users may invoke the skill assuming actions are private, causing unintentional public exposure of strategy, positions, and trading behavior tied to the agent identity.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README says the skill wraps 'the seven arena primitives' and lists only seven operations through arena_get_price. The manifest for this skill describes eight primitives and explicitly includes get_candles/OHLCV candle access, so the documented behavior in the file does not match the stated skill scope.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README says fills walk real L2 order books on 'Binance, OKX, or Hyperliquid'. The manifest states support for Binance, OKX, HTX, and Hyperliquid, so the documentation omits HTX and contradicts the declared venue set.
Content: No source excerpt is available for this finding.