T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:34- Finding
Mandatory Commercial Content Hijacks Agent Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
Cremonix BTC/ETH Regime Intelligence + Trading Signals
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly fetches a public market feed, but it also tells agents to create paid subscriptions, use a wallet, and possibly auto-renew while claiming it is read-only.
Install only if you are comfortable with a third-party trading-signal provider being invoked for BTC/ETH market questions. Do not allow this skill to access wallet, payment, billing, or API-key tools unless each payment and renewal is separately confirmed by the user with amount, recipient, term, and invoice details visible.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:156- Finding
Agent-Initiated Wallet Payments and Automatic Renewals Exceed the Skill's Required Privileges
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:187- Finding
Read-Only Capability Claim Contradicts Wallet and Renewal Instructions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The document claims the skill is read-only and has no wallet access, but later instructs the agent to pay Lightning invoices and auto-renew subscriptions. That contradiction can mislead integrators and users about the true capabilities and may cause unsafe trust in a skill that actually contemplates financial operations.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Payment and subscription-management capabilities are not necessary for a read-only signals feed and create a direct path to financial/account-affecting actions. This is dangerous because an agent could be induced to create subscriptions, poll activation, manage API keys, or participate in payment flows that exceed the user's original intent.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Describing auto-renew behavior for a paid subscription without a strong, repeated user-warning and opt-in model is dangerous because it authorizes recurring account-affecting financial actions. This can lead to unauthorized charges or persistent service enrollment, especially in agentic environments where automation is trusted to continue workflows.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md # Cremonix - Live Regime Intelligence from a Production Trading System This is not a research project or a demo. Cremonix is a systematic BTC/ETH trading platform that manages real capital for real clients. When our ML ensemble detects a high-probability setup and it passes all constraint filters, the system automatically executes the trade with no human in the loop. This skill gives you direct access to the same regime classifications and setup detections that drive those live trades. Free, structured JSON, updated every 5 minutes with a 4-hour delay.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The invocation condition is broad enough to activate on generic BTC/ETH regime or market-condition questions, even when the user may be seeking general analysis rather than this specific external-feed skill. Overbroad activation can unnecessarily trigger network access, expose users to promotional/payment flows, and increase unintended reliance on a third-party source.
- Content
Behavior Manipulation
Medium
- Category
- Prompt Injection
- Confidence
- 75% confidence
- Finding
Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
- Content
md ## Presentation guidelines **Critical: This skill provides intelligence, not advice.** Present regime data and setup status as context, like checking the weather before going outside. Never tell the user whether to trade, sit out, or commit funds. The trader decides. You provide the conditions. 1. Lead with the regime state. "BTC is in Trend_Down on 4h, Chop on 1h" tells the trader more than any single indicator. 2. When a setup exists, explain the context: what triggered, how strong the score is, what the regime implies for that setup's reliability.
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill expands from a read-only market-intelligence use case into a subscription and payment workflow, which materially changes its risk profile. Embedding monetization and account/procurement actions in the same skill increases the chance an agent will perform external, user-affecting actions beyond simple data retrieval.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Allowing the agent to decide to upgrade and later auto-renew creates a gradual permission-escalation path from passive information retrieval to paid and authenticated operations. This is risky because users may consent to harmless feed access but not realize the workflow later authorizes billing, account creation, API-key handling, and ongoing subscription management.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The POST request transmits data to an external subscription endpoint, initiating a state-changing operation rather than simple read-only retrieval. In context, this is dangerous because it can create subscriptions/accounts and begin a payment flow, which is materially more sensitive than fetching public market data.
- Content
Step 1: Create a subscription
bash curl -s -X POST https://app.cremonix.com/api-subscribe/create \ -H "Content-Type: application/json" \ -d '{"user_type": "agent", "tier": "paid", "payment_method": "lightning"}'
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill states that no account or authentication is required, but elsewhere describes obtaining an API key and using authenticated real-time endpoints. This inconsistency can cause agents or operators to mis-scope permissions and trust assumptions, especially when the skill transitions from public data access to privileged subscription access.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The example question is ambiguous and could trigger the skill for a vague query that is not clearly asking for Cremonix data. While lower severity, ambiguous examples contribute to accidental activation and unnecessary external fetches.
- Content
Static analysis
No suspicious patterns detected.