Security audit

KuCoin Trader

Security checks for vulnerabilities and agentic risk

Overview

This KuCoin skill is a real trading tool, but it can move funds and place leveraged trades with weak safeguards, so it needs review before installation.

Only install after reviewing the trading safeguards. Use a KuCoin API key with the minimum permissions needed, disable withdrawals, use exchange-side IP restrictions, and avoid futures or margin permissions unless required. The skill should be changed to require explicit confirmation or dry-run approval for every trade, borrow, repay, cancellation, and transfer, remove executable transfer defaults, remove the 125x futures default, and enforce strict credential file permissions.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/futures.js:235
Finding: Futures orders silently default to 125x leverage
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/spot.js:53
Finding: State-changing spot orders execute without a confirmation boundary
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/transfer.js:15
Finding: Transfer script performs a real 100 USDT transfer when invoked without arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/init.js:5
Finding: Credential directory creation does not enforce owner-only permissions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (60)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a broad KuCoin trading system capable of portfolio management actions such as transfers and spot/margin/futures trading across multiple accounts. The supplied code chunk is much narrower: it instantiates a single KuCoin client, fetches account data from several account types, retrieves prices, and prints a read-only asset overview. There are no calls suggesting order creation, order cancellation, transfers, position management, or multi-account orchestration. While checking balances is consistent with the description, the description materially overstates the capabilities shown in this code chunk, so this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description presents a broad KuCoin trading system covering multi-account support, spot/margin/futures trading, transfers, and portfolio management. The supplied code chunk is much narrower: it is a margin-focused command-line tool. It interacts with margin account endpoints (cross and isolated), borrowing/repayment, leverage setting, margin order placement, order queries, and cancellation. There is no evidence in this chunk of multi-account support, spot trading, futures trading, or asset transfer execution. In fact, the help text explicitly defers transfers to another script. Additionally, although 'enable' and 'disable' appear in the command list, the dispatcher never invokes the corresponding functions, so even some advertised margin-account management functionality is not actually exposed. Therefore, the declared description materially overstates what this code chunk does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description presents a broad KuCoin trading system covering multi-account management, spot/margin/futures trading, transfers, balances, and portfolio management. However, the supplied code only implements a spot trading CLI with three commands: place an order, view active spot orders, and cancel an order. It even explicitly defers transfers to another script. While the implemented spot trading behavior is consistent with part of the description, the overall declared purpose substantially overstates what this code chunk actually does. This is a description-versus-behavior mismatch because the code’s actual scope is materially narrower than the declared system capabilities.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The metadata marks the skill as always-on without clear activation boundaries, which is especially dangerous for a credentialed trading integration. In context, an always-available exchange skill could be selected during unrelated conversations and expose high-risk actions like querying balances, moving funds, or placing trades without sufficient contextual gating.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.
md
| `node scripts/accounts.js` | List all account balances |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
| `node scripts/query.js` | Query all active orders |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
node scripts/transfer.js --from main --to trade --currency USDT --amount 100

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
node scripts/transfer.js --from main --to trade --currency USDT --amount 100

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
node scripts/transfer.js --from main --to trade --currency USDT --amount 100

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
md
node scripts/spot.js trade --symbol BTC-USDT --side buy --type market --size 0.001

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.
md
node scripts/spot.js trade --symbol BTC-USDT --side buy --type market --size 0.001

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
md
node scripts/spot.js trade --symbol BTC-USDT --side buy --type market --size 0.001

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
md
node scripts/spot.js trade --symbol BTC-USDT --side buy --type market --size 0.001

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.
md
node scripts/spot.js trade --symbol BTC-USDT --side buy --type market --size 0.001

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
node scripts/spot.js trade --symbol BTC-USDT --side buy --type market --size 0.001

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
md
node scripts/margin.js borrowable --currency USDT

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
node scripts/margin.js borrowable --currency USDT

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.
md
node scripts/margin.js borrowable --currency USDT

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
md
node scripts/margin.js borrowable --currency USDT

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.
md
node scripts/margin.js borrowable --currency USDT

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.
md
node scripts/margin.js borrowable --currency USDT

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
md
node scripts/margin.js borrowable --currency USDT

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.
md
node scripts/margin.js borrowable --currency USDT

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.
md
node scripts/margin.js borrowable --currency USDT

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.
md
node scripts/margin.js borrowable --currency USDT

Static analysis

No suspicious patterns detected.