Cogdx Pre Trade Audit

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:02 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent about auditing and optionally placing trades, but it has high-impact live trading authority with weak safeguards and an unexplained scheduled runner.

Review before installing. Use only a least-privilege Simmer API key with strict account limits, avoid putting confidential strategy or personal data in the reasoning field unless you accept CogDx processing it, keep live=False unless you deliberately want real trades, and be cautious of the managed cron schedule because it is not explained by the user-facing instructions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: clawhub.json:3

Finding

Unpinned Runtime Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: clawhub.json:3-5
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

json

"requires": {
  "pip": ["simmer-sdk", "requests"],
  "env": ["SIMMER_API_KEY"]
},

Technical Analysis

The project declares simmer-sdk and requests without exact versions, package hashes, or a lockfile. Consequently, installation can retrieve whichever releases satisfy the unconstrained package names at that time.

This is particularly sensitive for simmer-sdk: the application imports it at runtime and initializes it with SIMMER_API_KEY. It then uses the resulting client to request live financial trades. A malicious or compromised dependency release would execute in the same process and security context as this skill.

No evidence indicates that the currently published packages are malicious. The confirmed weakness is the absence of dependency version and integrity controls, which makes the installed code dependent on mutable upstream package state.

Attack Path

1. An attacker compromises an upstream dependency, its publishing account, or its distribution infrastructure.
2. The attacker publishes a malicious release under one of the unconstrained package names.
3. A managed installation or update resolves and installs that release because no version or hash is pinned.
4. The malicious package executes when imported or used by the skill.
5. It reads process-accessible credentials such as SIMMER_API_KEY, modifies API operations, or submits unauthorized requests through the available trading context.

Impact Assessment

Successful exploitation would grant code execution with the privileges of the process running the skill. The attacker could access environment variables, including the Simmer API key, inspect trade theses and process data, alter audit or trading behavior, and potentially submit unauthorized trades within the ...[truncated 204 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an explicitly reviewed version, for example:

   json

   "pip": ["simmer-sdk==REVIEWED_VERSION", "requests==REVIEWED_VERSION"]
   

2. Use a lockfile or hashed requirements file that records exact transitive dependency versions and package hashes.
3. Install packages with hash verification enabled where supported.
4. Review the provenance and release history of simmer-sdk, because it receives a credential capable of initiating trading operations.
5. Add automated dependency scanning and require security review before accepting updates.
6. Run the skill with a narrowly scoped API key, restricted network access, and a dedicated low-privilege operating-system identity.

T09 · Insecure Skill Coding Practices

Warning

• Location: cogdx_pre_trade_audit.py:122

Finding

Missing Validation of Trade and Audit Parameters Can Weaken the Safety Gate

Content

View full analysis

Vulnerability Details

File Location: cogdx_pre_trade_audit.py:122-129 and cogdx_pre_trade_audit.py:184-191
Vulnerability Type: Missing server-side validation of security-sensitive and financial parameters
Risk Level: Medium

Vulnerable Code

python

def audit_and_trade(
    market_id: str,
    side: str,
    amount: float,
    reasoning: str,
    confidence: float = 0.5,
    min_validity: float = 0.7,
    block_on_error: bool = True,
    live: bool = False
) -> Dict[str, Any]:

The values are later forwarded to the trading SDK without validation inside audit_and_trade:

python

trade = client.trade(
    market_id=market_id,
    side=side,
    amount=amount,
    source=TRADE_SOURCE,
    skill_slug=SKILL_SLUG,
    reasoning=trade_reasoning
)

Approval also directly relies on the caller-provided threshold:

python

approved = validity >= min_validity and len(flaws) == 0

Technical Analysis

The public callable function does not enforce the documented constraints for its inputs. In particular, it does not ensure that:

• min_validity and confidence are finite values within the range from zero through one.
• amount is finite, positive, and below a configured maximum.
• side is either yes or no.
• market_id and reasoning are nonempty and appropriately bounded.

The CLI constrains side through argparse, but callers importing audit_and_trade directly bypass that CLI-only check. The README explicitly demonstrates direct module import, so the function boundary itself must enforce the constraints.

A negative min_validity weakens the cognitive safety check. For example, if the remote response has a missing or zero logical_validity value and no reported flaws, the code converts the score to zero and can approve it when the supplied threshold is negative. If live=True, unvalidated trade parameters are subsequently passed to ...[truncated 1594 chars]

Remediation

View remediation

Remediation Suggestions

Validate all inputs at the start of audit_and_trade, regardless of whether the function is invoked through the CLI:

1. Require side to be exactly yes or no.
2. Require market_id and reasoning to be nonempty strings and impose reasonable length limits.
3. Require amount to be finite, strictly positive, and no greater than a configurable per-trade maximum.
4. Require confidence and min_validity to be finite numbers within the inclusive range from zero through one.
5. Reject booleans where numeric values are expected, because Python treats booleans as integers.
6. Keep dry-run as the default and require an explicit, separately authorized control before live execution.
7. Apply account-level spending limits and transaction confirmation for high-value trades.
8. Validate the CogDx response schema and ensure logical_validity is a finite numeric value within the expected range before using it for approval.
9. Add tests covering negative, zero, non-finite, excessive, malformed, and boundary values.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The stated purpose centers on auditing trade reasoning, but the skill also indicates it can execute trades, use external APIs, and consume credentials. This mismatch is dangerous because users may invoke what appears to be an analysis-only skill while actually enabling financial transactions and secret-bearing network operations, creating a path to unauthorized trades or credential misuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

A pre-trade cognitive audit skill would reasonably analyze reasoning and return recommendations, but it is not inherently necessary for such a skill to initialize a trading client using SIMMER_API_KEY and connect to a market venue. This introduces a distinct market-execution capability unrelated to the declared diagnostic role.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is described as a pre-trade cognitive audit tool, but it also contains code to execute live trades. This creates a capability mismatch: users or orchestrators may invoke what appears to be an analysis-only skill and unintentionally grant it market-execution authority, increasing the risk of unauthorized or insufficiently reviewed financial actions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises no explicit tool scope or permissions, yet the content clearly implies use of environment variables and external network/API access. This is dangerous because an agent or operator may authorize and run the skill without understanding that it can access secrets and interact with external services, increasing the chance of unintended data exposure or side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill permits optional live trading but does not present a prominent warning about the risks of placing real trades. In a financial context, this is especially risky because users may treat the example as safe by default, then switch to live mode without appreciating the possibility of immediate monetary loss or unintended market actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

This request transmits the user's reasoning to an external domain, which is a real data exfiltration surface even if intended for legitimate analysis. Because the content is free-form and potentially sensitive, the skill context makes this more dangerous: a pre-trade thesis may reveal proprietary market views, wallet-related context, or confidential investment rationale.

Content

Scanner excerpt · cogdx_pre_trade_audit.py (reported line 62)May include surrounding context.

python

headers["X-WALLET"] = os.environ["COGDX_WALLET"]
    
    try:
        response = requests.post(
            f"{_cogdx_base_url}/reasoning_trace_analysis",
            headers=headers,
            json={"trace": reasoning},

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill sends the full user-provided reasoning trace to an external service without any explicit warning, consent flow, or minimization. Trade reasoning can contain proprietary strategy, personal data, account context, or sensitive decision logic, so this transmission can leak confidential information to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

When live mode is enabled, the code places a real trade immediately after passing the audit, without an additional confirmation step at the point of execution. In automated or chained-agent settings, this increases the chance of accidental real-money actions caused by parameter mistakes, prompt injection upstream, or misrouted invocations.

Content

No source excerpt is available for this finding.