Security audit

Simul8or Trader

Security checks for vulnerabilities and agentic risk

Overview

The skill’s simulated-trading purpose is clear, but it asks users to enable persistent autonomous trading with unpinned global packages, recurring agent runs, and API-key use.

Review this carefully before installing. Use it only in an isolated account or environment, pin and verify package versions, avoid enabling PM2 startup or recurring OpenClaw cron until you understand the behavior, and treat the API key and public profile as account-linked information that the agent may use repeatedly.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

Location: SKILL.md:20
Finding: Persistent Background Execution Through PM2 Startup and Scheduled Agent Tasks
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:143
Finding: Mandatory External-Service Promotion in Agent Responses
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:12
Finding: Unpinned Global Installation and Immediate Execution of Third-Party npm Packages
Content: View full analysis
Remediation: View remediation
` and `pm2@`. - Publish and verify package integrity hashes and source provenance before installation. - Use a lockfile or an equivalent reproducible installation mechanism. - Avoid global installation; install dependencies in an isolated project directory, container, or restricted runtime. - Review npm lifecycle scripts before installation and disable scripts where they are not required. - Do not automatically convert newly installed code into a startup service. - Run the package under a dedicated least-privileged account with narrowly scoped filesystem and network access. - Establish a controlled update process in which every new package version is reviewed and explicitly approved before deployment. - Monitor upstream package ownership, release signatures, dependency changes, and security advisories. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
You can go LONG (buy then sell) or SHORT (sell then buy back). ## Your Strategy <!-- Define your trading strategy here. Examples: - "Focus on momentum plays, ride trends, cut losers fast" - "Mean reversion only, buy dips, sell rips" - "Scalp crypto overnight, 1-2% targets"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The registration step sends user-provided identifying information (name and email) to an external service via curl. This is expected for account registration, but it is still an external data transmission and the skill does not prominently frame it as a privacy/security-sensitive action or explain what data leaves the system.
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

Register for an API key:

bash
curl -s -X POST https://simul8or.com/api/v1/agent/AgentRegister.ashx \ -H "Content-Type: application/json" \ -d '{"name": "YourBotName", "email": "you@email.com"}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to append to ~/price-history.jsonl and overwrite ~/commands.json, which modifies local user data/state without any user-facing warning or consent mechanism. Even though these writes are central to the trading workflow, they can unexpectedly persist data, clobber existing files, or interfere with other local processes if paths overlap or are reused.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs the agent to send the SIMUL8OR_API_KEY in HTTP requests to a remote service, but does not clearly warn the user that their credential will be transmitted and used autonomously for trading actions. In an agent setting, silent credential use increases the risk of unintended account activity, credential exposure through logs/tooling, or user confusion about what actions are being authorized.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.