Crypto & Stock Market Data Pro

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:14 PM UTC
• Version: 1.0.0

Overview

This market-data skill appears purpose-aligned, but it needs review because it caches an API token locally and can send that token to an environment-selected HTTP or untrusted API endpoint.

Install only if you are comfortable with the skill contacting api.igent.net, creating a local .token cache, and using a service-issued token for requests. Avoid running it with an untrusted API_BASE_URL environment variable, and prefer clearing or protecting artifact/scripts/.token on shared systems.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/api_client.js:8

Finding

API token can be transmitted to an arbitrary non-TLS endpoint

Content

View full analysis

Vulnerability Details

File Location: scripts/api_client.js, lines 8–91
Vulnerability Type: Unrestricted credential destination and plaintext token transmission
Risk Level: Medium

Vulnerable Code

js

const BASE_URL = process.env.API_BASE_URL || 'https://api.igent.net/api';

function _httpRequest(reqUrl, headers = {}) {
  return new Promise((resolve, reject) => {
    const parsed = new URL(reqUrl);
    const mod = parsed.protocol === 'https:' ? https : http;
    const options = {
      hostname: parsed.hostname,
      port: parsed.port,
      path: parsed.pathname + parsed.search,
      method: 'GET',
      headers: { 'User-Agent': USER_AGENT, ...headers },
    };

    const req = mod.request(options, (res) => {
      let body = '';
      res.on('data', (chunk) => (body += chunk));
      res.on('end', () => resolve({ status: res.statusCode, body }));
    });
    req.on('error', reject);
    req.end();
  });
}

async function getToken() {
  const token = _loadToken();
  if (token) return token;
  return _fetchNewToken();
}

async function get(endpoint, params) {
  let token;
  try {
    token = await getToken();
  } catch (e) {
    return { error: e.message };
  }

  const parsed = new URL(`${BASE_URL}${endpoint}`);
  if (params) {
    for (const [key, value] of Object.entries(params)) {
      parsed.searchParams.set(key, value);
    }
  }

  const headers = {
    accept: 'application/json',
    'X-API-Token': token,
  };

  try {
    const { status, body } = await _httpRequest(parsed.toString(), headers);

Technical Analysis

The API destination is controlled by the API_BASE_URL environment variable without protocol or hostname validation. The request helper explicitly supports both HTTPS and unencrypted HTTP. After loading a valid cached token, get() attaches it to the X-API-Token header and sends it to the configured de ...[truncated 1661 chars]

Remediation

View remediation

Remediation Suggestions

• Require https: for every authenticated request and reject all other protocols before loading or attaching a token.
• Restrict authenticated destinations to an explicit hostname allowlist, preferably only api.igent.net.
• Remove the API_BASE_URL override in production if alternate endpoints are not required.
• If configurability is necessary, separate trusted development configuration from production execution and validate the complete origin, including protocol, hostname, and port.
• Do not attach X-API-Token when the destination differs from the approved API origin.
• Ensure redirects are either disabled or revalidated before forwarding credentials.
• Invalidate or rotate any token suspected of having been sent to an untrusted destination.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/api_client.js:52

Finding

Cached API token is stored without explicitly restrictive file permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/api_client.js, lines 52–60
Vulnerability Type: Insecure local credential storage
Risk Level: Low

Vulnerable Code

js

async function _fetchNewToken() {
  const reqUrl = `${BASE_URL}/token`;
  const { status, body } = await _httpRequest(reqUrl);

  if (status === 200) {
    const data = JSON.parse(body);
    fs.writeFileSync(TOKEN_FILE, JSON.stringify(data));
    return data.token;
  }

Technical Analysis

The token response is written to scripts/.token without specifying a restrictive file mode. Consequently, the resulting permissions depend on the process umask and any permissions already present on the file.

On a multi-user system with a permissive umask or an existing broadly readable token file, another local account may be able to read the token. Authentication caching is documented and related to the Skill’s operation, but secure credential storage requires access controls that are not dependent solely on ambient system configuration.

Attack Path

1. The Skill runs with a permissive umask, or scripts/.token already exists with broad read permissions.
2. _fetchNewToken() retrieves a token and writes the complete token response to that file.
3. Another local user or process with access to the project directory reads scripts/.token.
4. The attacker extracts the token and replays it against the corresponding API before expiration.

Impact Assessment

Exploitation exposes the cached temporary API token to a local attacker who already has filesystem access sufficient to read the file. The attacker may consume the associated quota or invoke API operations authorized to the token until it expires or is revoked. No direct privilege escalation to the operating-system account is demonstrated, and the token’s exact server-side authorization scope is not established by the audited project.

Remediation

View remediation

Remediation Suggestions

• Create the token file with owner-only permissions, for example:

  js

  fs.writeFileSync(TOKEN_FILE, JSON.stringify(data), { mode: 0o600 });
  

• Validate and correct permissions on an existing token file before reading or overwriting it.

• Store the token in a user-specific secure state directory rather than inside the Skill’s source directory.

• Where feasible, retain short-lived tokens only in memory and avoid persistent storage.

• Delete expired tokens and provide a mechanism to revoke or clear compromised cached credentials.

• Avoid placing the project directory in shared or globally readable locations.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description claims no API key is needed and frames the skill as simple market-data access, but later discloses automatic token retrieval, authenticated requests, and local token persistence. This mismatch is dangerous because it can cause users or agents to execute the skill under false assumptions about authentication, state changes, and credential handling.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The description claims no API key is needed and frames the skill as simple market-data access, but later discloses automatic token retrieval, authenticated requests, and local token persistence. This mismatch is dangerous because it can cause users or agents to execute the skill under false assumptions about authentication, state changes, and credential handling.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises executable scripts and token-handling behavior but does not declare any explicit tool scope or permissions boundary. In an agent environment, missing scope declarations increases the chance that the skill can access environment data or run with broader privileges than users expect.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md

### Authentication
Authentication is handled **automatically** by the internal `api_client.js`. Here is how it works simply:

- **Endpoint**: `GET https://api.igent.net/api/token`
- **Mechanism**:
    1.  **Automatic Retrieval**: The first time you use a tool, it asks the server for a temporary session token.
    2.  **Local Storage**: This token is stored in a hidden `.token` file locally so it can be reused for subsequent requests.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly states that authentication tokens are written to a hidden .token file without warning users about credential persistence, retention, or file protections. Persisting tokens on disk can expose credentials to other local users, future processes, backups, or accidental commits, especially in shared or agent-managed environments.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The skill transmits data and authentication material to an external service and allows the destination to be overridden via the API_BASE_URL environment variable. Because _httpRequest supports both HTTP and HTTPS, a modified or misconfigured environment can redirect requests and tokens to an arbitrary insecure or attacker-controlled endpoint, enabling credential interception or data exfiltration.

Content

Scanner excerpt · scripts/api_client.js (reported line 8)May include surrounding context.

js

const path = require('path');
const url = require('url');

const BASE_URL = process.env.API_BASE_URL || 'https://api.igent.net/api';
const TOKEN_FILE = path.join(__dirname, '.token');
const USER_AGENT = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36';

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description suggests consumers do not need credential-style access, yet the implementation fetches a token from /token, stores it in a local .token file, and sends it in the X-API-Token header on subsequent requests. That is a semantic mismatch between the advertised access model and the actual behavior, even if the token is obtained automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The client writes token data directly to a local .token file without setting restrictive permissions or informing the user. On multi-user systems or permissive defaults, another local user or process could read the file and reuse the token to access the API as this skill, creating credential leakage risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The client transmits an API token in the X-API-Token header during network requests, but the code provides no confirmation, visible notice, or explanatory comment/docstring that authentication data will be sent to a remote service. This is a network operation involving sensitive data and falls under missing user warnings for code files.

Content

No source excerpt is available for this finding.