cTrader Commander

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:25 AM UTC
• Version: 1.0.0

Overview

This skill is not proven malicious, but it needs review because it can control real cTrader accounts through an unauthenticated local proxy and depends on running unpinned external code with credentials.

Only install this after reviewing the proxy repository yourself and preferably pinning it to a known commit. Use a demo or limited-risk cTrader account, restrict access to localhost:9009, avoid shared/container network exposure, and require your own explicit confirmation before any order, close, cancel, or account-switch action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: endpoints.md:3
• Finding: Unauthenticated Credential-Backed Trading Interface## Vulnerability Details **File Location**: `endpoints.md:3-16`; related instructions in `SKILL.md:11` and `SKILL.md:217-219` **Vulnerability Type**: Missing authentication and overly broad command access **Risk Level**: High ### Vulnerable Code ```markdown Base URL: `http://localhost:9009` No token or API key is needed by callers. All credentials live in `.env` on the server. --- ## REST Endpoints | Method | Path | Description | |---|---|---| | `POST` | `/api/set-account` | Switch active account (optional — auto-set from `.env` on startup) | | `POST` | `/api/trendbars` | OHLC candle data | | `POST` | `/api/live-quote` | Recent tick/quote data | | `POST` | `/api/market-order` | Place market, limit, or stop order | | `GET` | `/get-data?command=...` | Generic passthrough for any cTrader command | ``` The generic endpoint exposes sensitive commands including: ```markdown | `ProtoOAGetAccountListByAccessTokenReq` | — | List all accounts on this token | | `ProtoOATraderReq` | — | Account details (balance, equity, leverage) | | `ProtoOAReconcileReq` | — | Open positions and pending orders | | `NewMarketOrder` | `symbolId tradeSide volume comment [sl] [tp]` | Place market order | | `NewLimitOrder` | `symbolId tradeSide volume price` | Place limit order | | `NewStopOrder` | `symbolId tradeSide volume price` | Place stop order | | `ClosePosition` | `positionId volumeInUnits` | Close an open position | | `CancelOrder` | `orderId` | Cancel a pending order | ``` ### Technical Analysis The proxy performs credential-backed financial operations without requiring a caller token or API key. It relies on the service being reachable through `localhost`, but local network placement is not an authentication or authorization control. Any local process, compromised agent, malicious browser-assisted request path, or container sharing the relevant network namespace may be able to invoke the interface. The generic ...[truncated 2522 chars]
• Remediation: ## Remediation Suggestions 1. Require cryptographically strong authentication for every request, even when the service binds only to loopback. 2. Prefer a protected Unix-domain socket or equivalent OS-controlled IPC mechanism over an unauthenticated TCP listener. 3. Implement per-operation authorization and separate read-only market-data access from account-data and trading permissions. 4. Remove the generic command passthrough. Replace it with explicit, allowlisted endpoints that validate all command names and arguments. 5. Disable account enumeration and runtime account switching unless they are essential. Restrict account IDs to an administrator-configured allowlist. 6. Require explicit user confirmation immediately before every financial mutation, including order placement, position closure, cancellation, and account switching. 7. Apply server-side limits for volume, position size, instrument selection, order frequency, and maximum financial exposure. 8. Validate all request fields against strict schemas and reject unknown properties, unsupported commands, malformed identifiers, and out-of-range values. 9. Add rate limiting, request auditing, immutable transaction logs, and alerts for sensitive operations. 10. Run the proxy under a dedicated low-privilege OS identity and prevent untrusted containers or processes from reaching its listening interface. 11. Avoid plaintext HTTP where traffic can cross a namespace or host boundary; use authenticated encryption when IPC cannot remain strictly local.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:13
• Finding: Execution of an Unpinned External Proxy Repository## Vulnerability Details **File Location**: `SKILL.md:13-14`; repeated startup instruction at `SKILL.md:119-124` **Vulnerability Type**: Unpinned and externally mutable dependency execution **Risk Level**: High ### Vulnerable Code ```markdown > **Proxy repo:** https://github.com/LogicalSapien/ctrader-openapi-proxy > Clone it, add your `.env`, and run `make run` to start the proxy before using this skill. ``` The later startup instruction executes the repository's Make target: ```bash cd ~/ctrader-openapi-proxy && make run ``` ### Technical Analysis Users are instructed to clone a mutable external GitHub repository, place credentials in its `.env` file, and execute `make run`. No reviewed commit hash, signed release, checksum, dependency lock, or source-integrity verification is specified. A Make target can execute arbitrary shell commands with the privileges of the invoking user. Consequently, the effective code executed by these instructions may change after the Skill itself has been reviewed. If the upstream repository, maintainer account, release process, or dependency chain is compromised, an attacker can modify the Makefile or proxy source and have users execute the changed payload. The risk is amplified because the external component is intentionally given cTrader credentials and authority to submit financial transactions. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or another dependency used by the proxy. 2. The attacker modifies the default branch or Make target to include a malicious command, credential collector, or altered trading behavior. 3. A user follows the Skill instructions and clones the current repository state without verifying a commit or signature. 4. The user adds a credential-bearing `.env` file to the repository directory. 5. The user runs: ```bash cd ~/ctrader-openapi-proxy && make run ``` 6. The malicious Make recipe or ...[truncated 1051 chars]
• Remediation: ## Remediation Suggestions 1. Pin the proxy to a specific reviewed commit hash rather than cloning and executing the mutable default branch. 2. Prefer a signed, versioned release and verify its signature and cryptographic checksum before use. 3. Vendor the required proxy source into the audited package when licensing and maintenance requirements permit. 4. Review the Makefile and all scripts invoked by `make run` before execution. 5. Lock all transitive dependencies using integrity-protected lockfiles and verify them during installation. 6. Run the proxy in a sandboxed container or dedicated low-privilege account with a read-only filesystem wherever possible. 7. Mount only the minimum required credential material and avoid placing `.env` in a directory writable by external build steps. 8. Restrict outbound network access to the documented cTrader endpoints so a compromised proxy cannot freely exfiltrate secrets. 9. Use narrowly scoped, revocable credentials and a dedicated trading account with server-side financial limits. 10. Document an upgrade process requiring review, signature verification, and explicit approval before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

External Script Fetching

High

• Category: Supply Chain

Content

```
Example — close position 123456 with 1000 units (0.01 lot):
```bash
curl -s "http://localhost:9009/get-data?command=ClosePosition%20123456%201000"
```

---

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The generic passthrough allows arbitrary cTrader API commands via a free-form `command` parameter, which effectively turns the skill into an unconstrained broker control surface. If an agent can relay user-controlled input into that parameter, it can perform unintended, high-impact actions against the trading account beyond the reviewed endpoints.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The generic `/get-data?command=...` passthrough effectively exposes a broad command execution interface to the local trading proxy, including account switching, order placement, position closing, and cancellation. For a skill described as a constrained trading assistant, this is an unsafe capability escalation and bypass of endpoint-specific validation, making misuse or prompt-driven abuse far more likely.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Check proxy is running

```bash
curl -s "http://localhost:9009/get-data?command=ProtoOAVersionReq"
```

If it fails, start the proxy: `cd ~/ctrader-openapi-proxy && make run`

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill provides direct live-trading instructions without prominent warnings about financial risk, real-money execution, or irreversibility. In this context, missing safety friction materially increases the chance of accidental loss because the documented commands can immediately place real orders on an account whose credentials are already loaded server-side.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Position-closing and order-cancellation commands are destructive trading actions, yet they are documented without clear warnings or confirmation guidance. In a trading skill backed by preconfigured credentials, this increases the risk of accidental liquidation or cancellation of intended strategy orders.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documented capability set exceeds the manifest’s stated trading and market-data scope by exposing account switching and a generic command passthrough. That mismatch is dangerous because an agent or user may invoke privileged broker operations not anticipated by policy, enabling broader account manipulation than the skill description suggests.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Runtime account switching expands the blast radius from a single configured account to potentially any account the proxy is authorized to access. Because this capability is not disclosed in the manifest purpose, agents or users may unintentionally operate on the wrong account, causing mis-trades, data exposure, or destructive actions in a different environment.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Describing the passthrough as usable for 'any cTrader API command' gives the skill an overly broad operational scope with no meaningful constraints. That makes prompt-driven misuse more likely, because the agent is invited to relay arbitrary broker commands without guardrails, validation, or least-privilege boundaries.

External Transmission

Medium

• Category: Data Exfiltration

Content

```
2. Check your account details:
   ```bash
   curl -s "http://localhost:9009/get-data?command=ProtoOATraderReq"
   ```
3. Place a market buy:
   ```bash

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The endpoint reference exposes a much broader capability set than the stated skill description, including a generic command passthrough that can invoke arbitrary trading and account operations. This creates a dangerous mismatch between what users or upstream agents may believe the skill can do and what it can actually execute, increasing the risk of unauthorized or unexpected financial actions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation describes live order placement for market, limit, and stop orders but provides no warning that these actions can create irreversible financial exposure or losses. In an agent setting, lack of explicit safety framing and confirmation expectations materially increases the chance of accidental execution of real trades.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The generic passthrough interface documents close, cancel, and order actions without any destructive-action warning or explicit safety controls. Because these commands are one-step invocations over HTTP and no token is required at call time, the absence of warnings and friction significantly raises the chance of unintended or unsafe account modifications.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documented commands include account enumeration, symbol discovery, and broad account/market metadata retrieval beyond the narrow manifest description. While some are read-oriented, they expand reconnaissance and account insight available to any caller, which can enable more targeted or harmful follow-on trading actions.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: Position closing and order cancellation are materially destructive trading capabilities that are absent from the manifest description. Hiding or under-declaring these actions makes the skill more dangerous because users and orchestrators may invoke it without realizing it can directly alter or liquidate live positions.

Static analysis

No suspicious patterns detected.