T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:14
- Finding
- Untrusted YouTube Content Can Influence Automated Financial Trades## Vulnerability Details **File Location**: `SKILL.md`, lines 14-19 **Vulnerability Type**: Untrusted content used to drive sensitive financial actions without an approval boundary **Risk Level**: High ```markdown 3. **Extract video IDs**: From snapshot, find investment-related videos 4. **Get subtitles**: - First try: `yt-dlp --write-subs --skip-download --sub-lang zh-Hans,en <video_url>` - If no subtitles: Download video + whisper-cpp analysis 5. **Analyze**: Summarize investment recommendations 6. **Execute trades**: Use tiger-trade skill ``` ### Technical Analysis The workflow obtains titles, subtitles, and transcribed speech from externally controlled YouTube videos, analyzes that content for investment recommendations, and then directs the agent to invoke a trading skill. YouTube media and metadata are untrusted inputs that may contain misleading financial claims or adversarial instructions designed to manipulate an AI agent. No control is specified to separate media content from executable instructions. The workflow also lacks a trusted-source policy, independent recommendation validation, transaction limits, asset allowlists, and mandatory confirmation of the final order parameters. Consequently, content selected from a notification can influence a sensitive action with real financial consequences. ### Attack Path 1. An attacker publishes or compromises a YouTube video containing manipulated investment recommendations or adversarial instructions. 2. The video is surfaced in the user's YouTube notifications as investment-related content. 3. The skill extracts the video identifier and obtains attacker-controlled subtitles or transcribes the media. 4. The agent analyzes that untrusted content and derives a recommendation to buy, sell, or otherwise trade an asset. 5. The workflow invokes the `tiger-trade` skill without requiring the user to review and explicitly approve the exact order. 6. If the co ...[truncated 590 chars]
- Remediation
- ## Remediation Suggestions 1. Make the skill analysis-only by default and remove automatic progression from content analysis to trade execution. 2. Treat video titles, descriptions, subtitles, comments, and transcriptions strictly as untrusted data. Explicitly prohibit following instructions embedded in that content. 3. Require explicit user approval immediately before every order. Present the asset, side, order type, quantity, limit price, estimated value, account, and maximum possible loss. 4. Bind approval to an immutable order preview so that no parameter can change after confirmation. 5. Enforce asset allowlists, per-order value limits, daily exposure limits, position-size controls, and restrictions on leveraged or illiquid instruments. 6. Validate recommendations against independent and trusted market data rather than relying on a single video. 7. Require trusted-channel or creator allowlists and clearly identify the provenance of every recommendation. 8. Run the analysis component without access to trading credentials. Grant narrowly scoped trading capability only after confirmation through a separate authorization boundary. 9. Record the source video, extracted recommendation, validation results, order preview, user approval, and final execution result in an audit log while excluding credentials and other sensitive account data.