Security audit

TraderBro - Credit Rating for Investment Influencers

Security checks for vulnerabilities and agentic risk

Overview

The skill is a financial research CLI helper, but it delegates agent workflows to mutable remote instructions without clear safeguards.

Review this carefully before installing. The main issue is not the market-data queries themselves, but that the skill asks the agent to fetch and follow TraderBro-hosted workflows that can change after review. Use it only if you trust TraderBro as an instruction source, keep the API key secret, and consider confirming any workflow steps before allowing consequential financial or account-related actions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:30
Finding: Unaudited Remote Workflow Instructions Can Hijack Agent Behavior
Content: View full analysis
``` Always run `traderbro skills list --json` first when the user's request matches a skill's `trigger_keywords`. ``` ### Technical Analysis The skill instructs the agent to retrieve workflow instructions from the external TraderBro service and use those instructions to determine subsequent actions. Neither the workflow contents nor their `trigger_keywords` are included in the audited package. They are therefore mutable, unaudited inputs controlled by the remote service. The responses are described as instructions that tell the agent how to chain CLI commands, rather than as untrusted informational data. No validation, command allowlist, response schema enforcement, trust-boundary warning, or user-confirmation requirement is specified before the agent follows a retrieved workflow. This creates an instruction-hijacking boundary: the reviewed local skill delegates part of its effective behavior to content that may change after review. ### Attack Path 1. A user submits a request involving financial analysis, research, or purchasing decisions. 2. The local skill requires the agent to run `traderbro skills list --json`. 3. A malicious or compromised TraderBro service returns attacker-controlled skill names, trigger keywords, or metadata. 4. The agent matches the user's request against a remotely supplied `trigger_keywords` value. 5. The agent runs `traderbro skills show ` and receives attacker-controlled workfl ...[truncated 1086 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:5
Finding: Unpinned Third-Party Homebrew Tap Creates Supply-Chain Exposure
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The markdown includes steps to generate an API key and export it as TRADERBRO_API_KEY, which is a credential-related operation covered by the missing-warning rule for markdown files. There is no accompanying warning about keeping the key secret, avoiding shell history exposure, or treating environment variables as sensitive.
Content: No source excerpt is available for this finding.