Security audit

Duola Quant Copy Engine

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed trading workflow, but it asks users to install a mutable CLI and provide financial secrets for live automated trading in ways that need careful review.

Install only after independently trusting the `duola` package and publisher, prefer a pinned and verified local install, use a dedicated low-value wallet, avoid typing real private keys directly into shell commands, protect SkillPay credentials, and monitor or stop any detached live-trading process promptly.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:42
Finding: Unpinned Third-Party Package Receives Financial Credentials and Live-Trading Authority
Content: View full analysis
' | duola autopilot onboard \ --name --private-key-stdin --profile balanced --sync-limit 200 ``` ### Technical Analysis The Skill directs operators to install the latest available `duola` npm package globally without pinning an audited version, verifying an integrity digest, using a lockfile, or validating package provenance. Running `npm view duola version` only reports registry metadata and does not establish that the package or a newly published release is trustworthy. A mutable package version can change after the Skill has been reviewed. npm installation may also execute package lifecycle scripts. The resulting executable is later supplied with a wallet private key and authorized to perform live financial trades, substantially increasing the consequences of a dependency compromise. This finding does not establish that the current `duola` package is malicious. It identifies an unsafe supply-chain trust model in which a compromised publisher account, malicious release, registry compromise, or package substitution could place attacker-controlled code in a privileged financial workflow. ### Attack Path 1. An attacker compromises the npm publisher account, registry distribution path, or a future `duola` release. 2. The attacker publishes a modified package containing a malicious lifecycle script or runtime behavior. 3. An operator follows the Skill and runs `npm install -g duola`. 4. The malicious code executes during installation or when the CLI is invoked. 5. Dur ...[truncated 1116 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:83
Finding: Wallet Private Key May Be Persisted in Shell History
Content: View full analysis
' | duola autopilot onboard \ --name --private-key-stdin --profile balanced --sync-limit 200 ``` ### Technical Analysis The command uses standard input for the `duola` process, which prevents the private key from appearing directly in that process's argument list. However, the documented invocation instructs the operator to place the key as a quoted literal in the shell command passed to `printf`. When used interactively, many shells record the complete command in a persistent history file. The secret may consequently remain readable after the onboarding process finishes. It may also be captured by terminal logging, session recording, command auditing, clipboard managers, support bundles, or backups containing shell history. The `--private-key-stdin` option does not mitigate these exposures if the key is first embedded directly in the command line. ### Attack Path 1. An operator replaces `` with a real wallet private key. 2. The operator executes the command in an interactive shell. 3. The shell or terminal records the complete command, including the plaintext key. 4. An attacker, another local account with sufficient access, malware, a support process, or a backup reader obtains the history or session record. 5. The attacker extracts the private key. 6. The attacker imports the key into another wallet client and performs transactions authorized by that key. ### Impact Assessment Disclosure of the private key can grant control over all wallet assets and permissions governed by that key. Potential consequences include: - Irreversible theft of wallet-controlled funds. - Unauthorized Polymarket or other blockchain transactions. - Impersonation of the wallet owner. - Abuse of token approvals or proto ...[truncated 320 chars]
Remediation: View remediation
&2 printf '%s' "$DUOLA_PRIVATE_KEY" | duola autopilot onboard \ --name --private-key-stdin --profile balanced --sync-limit 200 unset DUOLA_PRIVATE_KEY ``` 3. Prefer retrieving the key from an approved secret manager and passing it through a protected file descriptor or short-lived standard-input stream. 4. If a file must be used, create it with restrictive permissions, avoid shared temporary directories, securely remove it after use, and account for filesystem snapshots and backups. 5. Explicitly warn operators never to substitute a real key into a command-line placeholder. 6. Disable terminal session recording and prevent clipboard persistence while handling the key. 7. Use a dedicated wallet with limited funds and permissions for automated trading. 8. If the documented command has already been used with a real key, treat that key as compromised: migrate assets, revoke approvals where possible, rotate related credentials, and securely remove exposed history and logs. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill includes an example showing a live API key environment variable (SKILLPAY_API_KEY) but does not explicitly warn users to protect the secret, avoid hardcoding real credentials, or use a secret manager. In an agent workflow, users may copy this block verbatim into shell history, logs, screenshots, or shared config, increasing the chance of credential exposure and unauthorized billing API use.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.