Security audit

Research Strategy

Security checks across malware telemetry and agentic risk

Overview

This skill is openly designed to run autonomous trading-strategy research, but it can keep running, spawn agents, and modify trading code without clear human approval.

Review this skill carefully before installing. It should only be used in a disposable or well-controlled trading research workspace, not a live trading project, unless you are comfortable with background processes, spawned agents, automatic strategy-file creation, source rewriting, and promotion of generated strategies without per-action confirmation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill clearly instructs reading and creating files in the workspace, but the manifest does not declare permissions for those capabilities. This weakens user awareness and permission boundaries, making it easier for the skill to modify project files unexpectedly under the guise of routine workflow automation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill advertises a research workflow centered on searching and testing strategies, but the observed behavior includes undeclared autonomous file movement, code rewriting, and reporting actions. This mismatch is dangerous because users may consent to research assistance while the skill actually performs deployment-like changes to source code and project state.

Intent-Code Divergence

High

Confidence: 90% confidence
Finding: The manifest requires market-intel-assistant for search, but the sub-agent template instructs web_search instead, creating a policy contradiction. Such inconsistencies undermine control over tool usage and can bypass intended oversight, logging, or safety constraints associated with the mandated search skill.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The script automatically modifies strategy source files and moves them from a test directory into a formal production strategy directory based solely on simplistic backtest thresholds. In a trading-skill context, this is dangerous because unreviewed code promotion and blind source rewriting can introduce unsafe logic, operational failures, or malicious strategy code into live or trusted paths without human approval.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs automatic directory and file creation in the project without warning the user that the workspace will be modified. Silent file writes are risky because they can pollute the repository, overwrite expected structure, or set up later execution paths without informed consent.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill directs background execution of scripts and continuous looping, which can start autonomous subprocesses that continue acting after the initial interaction. In a trading-code workspace, this is especially dangerous because unattended processes may consume resources, alter files, or trigger repeated workflow actions without visibility or consent.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The sub-agent template explicitly instructs autonomous execution, repeated cycling, and no-confirmation behavior, extending unsafe automation into spawned agents. This compounds risk because a sub-agent can continue modifying code, launching processes, and iterating strategy generation beyond the user's immediate oversight.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal