backtrader

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:44 PM UTC
• Version: 1.0.2

Overview

This appears to be a legitimate Backtrader guide, but it needs review because it mixes local backtesting with live-trading and automation guidance without clear safety boundaries.

Install only in an isolated Python environment, avoid using broker credentials or live-trading connectors unless you explicitly intend to trade, and treat the strategy examples as educational backtests unless you add your own paper-trading, position-limit, and confirmation safeguards.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unbounded and Unverified Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-2
Additional Locations: SKILL.md:18-22, demo_project/README.md:7-10
Vulnerability Type: Supply-chain exposure through unbounded dependencies
Risk Level: Medium

Vulnerable Code:

text

backtrader>=1.9.0
matplotlib>=3.0.0

The associated installation instructions execute dependency resolution without version or integrity verification:

bash

pip install backtrader
pip install backtrader[plotting]
pip install matplotlib

bash

pip install -r ../requirements.txt

Technical Analysis

Both dependencies specify only minimum versions and do not impose upper bounds, exact version pins, lock-file constraints, or cryptographic hashes. Consequently, each installation may resolve to a different package release, including releases published after this audit.

The reviewed package names and referenced upstream URLs appear legitimate; there is no evidence of typosquatting, dependency confusion, or an actively malicious release in the audited files. The vulnerability is the absence of controls ensuring that users install the same reviewed dependency artifacts.

Python packages can execute package-controlled code during installation or when imported. If an upstream account, package repository, distribution artifact, or future dependency release is compromised, following the documented installation process could execute attacker-controlled code.

Attack Path

1. An attacker compromises an allowed upstream package release or its distribution channel.
2. The attacker publishes a version satisfying backtrader>=1.9.0 or matplotlib>=3.0.0.
3. A user follows the documented command pip install -r ../requirements.txt or one of the unpinned installation commands.
4. Pip resolves and downloads the compromised version because no exact pin or trusted hash rejects it.
5. Malicious package code executes during ...[truncated 789 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace minimum-only constraints with exact versions that have been tested and reviewed:

   text

   backtrader==<reviewed-version>
   matplotlib==<reviewed-version>
   

2. Generate and commit a lock file that includes all transitive dependencies.
3. Record cryptographic hashes for every permitted distribution and install with:

   bash

   pip install --require-hashes -r requirements.txt
   

4. Use a controlled package index or internal artifact mirror with provenance and access controls.
5. Add automated dependency vulnerability, provenance, and license scanning to the release process.
6. Update dependencies through reviewed change requests rather than allowing automatic resolution to arbitrary future versions.
7. Perform installation in an isolated virtual environment or non-privileged container, and never run pip as root unless strictly necessary.
8. Update SKILL.md and demo_project/README.md so all documented installation commands use the locked, hash-verified dependency file.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill prominently describes trading strategies, order placement, broker behavior, and even mentions live trading support, but it does not warn that similar code patterns may place or simulate real orders depending on environment configuration. In an agent context, this omission is dangerous because users or automation may over-trust the examples and reuse them in connected brokerage setups without adequate financial-risk, authorization, or environment-safety checks.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The AI-agent section instructs users to perform API-based data retrieval, periodic monitoring, and automated alerting even though this skill only documents a local backtesting library and does not provide those capabilities itself. This mismatch can mislead an agent into fabricating unsupported integrations or building unsafe automation around financial workflows without clear boundaries, increasing the chance of unintended network access, hallucinated tool use, or risky operational behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document is entirely written in Chinese, including the title and all instructional text, with no indication that other languages are supported or that Chinese is a region-specific requirement. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The README is entirely written in Chinese, including the title, feature descriptions, and usage guidance, with no indication that the skill is intentionally limited to a Chinese-speaking audience or that another language option is available. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description and the rest of the markdown consistently force Chinese-language content, but there is no opt-in or indication that this skill is intentionally limited to Chinese-speaking users. The policy for natural-language content says to flag forced language or locale constraints unless the choice is offered or clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README instructs users entirely in Chinese, including setup and execution steps, which may impose a specific language on users without explicit opt-in. The policy allows locale or language constraints when users are given a choice or when the constraint is clearly documented and justified, neither of which appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's user-facing print statements are entirely in Chinese, which imposes a specific language choice on users without offering an alternative or documenting that the skill is intended only for a Chinese-speaking audience. This matches the language/locale policy concern for natural-language content in code files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The natural-language description at L04 forces a specific language presentation for the skill metadata. Under the policy, language constraints should either be optional for users or clearly justified as region-specific, and neither is present here.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified with only a lower bound, which allows future unreviewed versions of backtrader to be installed. This creates supply-chain risk because a compromised or incompatible upstream release could be pulled into the environment without explicit approval, affecting reproducibility and potentially introducing malicious code during installation or runtime.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

backtrader>=1.9.0
matplotlib>=3.0.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The matplotlib dependency is also unpinned except for a minimum version, so builds may resolve to any newer release. That weakens reproducibility and increases supply-chain exposure, since a malicious or breaking upstream package version could be fetched automatically and executed in the Python environment.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

backtrader>=1.9.0
matplotlib>=3.0.0

Static analysis

No suspicious patterns detected.