T08 · Insecure Dependencies
Warning
- Location
calibration_report.py:27- Finding
Unpinned Third-Party Dependency Executes in a Runtime Containing a Trading API Key
- Content
View full analysis
- Remediation
View remediation
Security audit
Simmer Calibration Report
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly performs the advertised local trading-journal analysis, but it asks for an unnecessary trading API key and can read live journal data unexpectedly, so it needs review before installation.
Install only after you are comfortable giving this scheduled report access to local trading journals and a SIMMER_API_KEY. Prefer setting CALIB_JOURNAL_PATH explicitly, avoid providing live credentials unless the skill is revised to need them, and use a pinned trusted simmer-sdk version.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A description-behavior mismatch is dangerous because users may trust the skill to perform financial analysis when it reportedly only inspects status/configuration and does not compute the promised calibration metrics. In a trading-journal context, this can lead to incorrect decisions, false assurance, and misuse of API keys or local data under misleading pretenses, even if there is no overtly malicious payload.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The journal discovery logic for non-live mode explicitly appends the live journal path as a fallback, causing a supposedly sim-focused analytics skill to read real trading history without an explicit user opt-in. This creates a data-scope violation and can expose or process sensitive live trading activity unexpectedly, especially in automated or shared environments.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The markdown explicitly tells users to set
SIMMER_API_KEY, which is a sensitive credential, but provides no warning about keeping it secret or avoiding shell history/shared environments. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect privacy or system integrity.- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill's stated purpose is local calibration reporting over trade journals, but the file includes a
SimmerClientinitializer that reads API credentials and configures a live/sim trading venue. That capability is not used anywhere in the reporting flow and is not justified by the manifest's analytics-only purpose. Even unused, retaining trading-client setup expands the code's apparent authority and intent surface.- Content