Cex Trader

• Outcome: Review
• Latest audit: Jun 18, 2026 · 10:42 AM UTC
• Version: 2.0.3

Overview

This is a coherent crypto trading skill, but it can send exchange API keys to a hosted MCP service and place live leveraged trades without enough scoping or safety disclosure.

Install only if you trust the hosted MCP operator with exchange API credentials and live trading authority. Use API keys with withdrawals and transfers disabled, IP restrictions where available, small limits or testnet first, and require explicit human confirmation before orders, leverage changes, credential setup, or full position closure. Avoid sending setup credentials to non-HTTPS or untrusted MCP_SERVER_URL values.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tainted flow: 'req' from os.environ.get (line 36, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            return json.loads(resp.read().decode())
    except urllib.error.HTTPError as e:
        body = e.read().decode()

• Confidence: 95% confidence
• Finding: The CLI builds its destination URL from the MCP_SERVER_URL environment variable and then sends requests to it, including sensitive trading commands and, in setup flows, exchange API credentials. Because the default scheme is plain HTTP and there is no validation or allowlist on the endpoint, a modified environment can redirect secrets and trading actions to an attacker-controlled service or over an unencrypted channel.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill exposes sensitive capabilities—environment-variable access, network communication, and shell/file-manipulation behavior—without an explicit permission declaration. In a trading skill that handles exchange API credentials and connects to a remote MCP endpoint, this weakens user trust boundaries and can lead to credential exfiltration or unexpected local-system changes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The documented purpose focuses on trading functions, but the skill also performs local persistence under ~/.trader and changes file permissions via chmod. Behavior outside the stated scope is dangerous because users may authorize a trading tool without realizing it will modify the local environment, creating opportunities for stealthy persistence or abuse if the skill or its dependencies are compromised.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The documentation says credentials are not stored on disk, yet the skill provides a credential-saving tool, creating an inconsistency about where secrets reside. For exchange API keys, ambiguous storage semantics are risky because users cannot accurately assess whether long-lived secrets are being persisted locally or remotely, increasing the chance of accidental exposure.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: Broad trigger phrases like 'buy crypto', 'sell crypto', 'swap tokens', or generic trading terms can cause the skill to activate on ordinary finance-related conversation without a deliberate user request. In a high-risk domain involving live order placement and leverage, unintended invocation is especially dangerous because it can escalate from informational intent to real trading actions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill discusses saving and transmitting exchange API credentials but does not give prominent, specific privacy and security warnings about the consequences of sending secrets to a hosted MCP server. Because these credentials can authorize account access and trading, insufficient disclosure can lead users to expose high-value secrets without understanding custody, retention, breach, or misuse risks.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The examples include immediate trading actions such as market open and close operations on leveraged futures without any embedded warning that these calls can execute real, irreversible trades on a live exchange account. In an agent skill whose purpose is automated trading, example payloads strongly influence downstream agent behavior, so omission of safety framing or confirmation requirements can cause unintended financial loss.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The close-position example demonstrates a one-call action that liquidates an entire futures position using a market order, yet it does not disclose that the action is irreversible and may realize losses immediately. Because this skill is specifically for exchange trading automation, such a concise example can be copied by an agent or integrator without adding user confirmation or environment checks.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The setup command accepts apiKey and secretKey and forwards them to the MCP server over HTTP by default, with no transport-security guarantee or user warning. This can expose exchange credentials to local network interception, proxying, or a maliciously redirected MCP endpoint, which is especially dangerous in a trading skill because stolen keys can enable account takeover and fund loss.

Static analysis

No suspicious patterns detected.