Security audit

ibkr-cli

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real brokerage CLI guide, but it defaults ambiguous setup to live Interactive Brokers profiles, which can expose real account data and set up later live trading by mistake.

Review carefully before installing. Use paper profiles by default, choose live profiles only with explicit intent, confirm the account before any order, preview every trade first, and avoid using this skill for general stock research unless you specifically want IBKR-backed commands.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: references/setup.md:27
Finding: Unsafe Live-First Brokerage Profile Selection
Content: View full analysis
`live` (port 7496) > `gateway-paper` (port 4002) > `paper` (port 7497). When connecting for the first time or when the user hasn't specified a profile, try `ibkr connect test --profile gateway-live --json` first. If it fails, try the next profile in the priority list. Once a working profile is found, use it for subsequent commands. - **Profile flag**: Most commands accept `--profile`. Always be explicit about which profile to use. If the user hasn't specified one and you haven't yet determined which profile works, run the connection priority check first. ``` From `references/setup.md:27-29`: ```markdown ### Choosing a profile When the user hasn't specified whether they want paper or live trading, verify connectivity in priority order: `gateway-live` (4001) > `live` (7496) > `gateway-paper` (4002) > `paper` (7497). Use `ibkr connect test --profile --json` to check each. The first successful connection is the one to use. Only default to paper if the user explicitly says they want paper trading, or if no live connection is available. ``` ### Technical Analysis The Skill directs the Agent to probe and select live brokerage profiles before paper profiles when the user has not explicitly selected an environment. This violates the fail-safe-default principle because an ambiguous request is resolved in favor of the environment capable of executing real-money transactions. The trading guide does require either `--preview` or `--submit` and recommends previewing orders first. That control reduces accident ...[truncated 1943 chars]
Remediation: View remediation
paper ``` 2. Do not automatically fall back from paper to live. Treat live selection as a separate, explicit user decision. 3. Before connecting to a live profile, obtain contemporaneous confirmation that clearly states: - The profile name. - Whether the environment is live. - The target account or masked account identifier. 4. Before every live `--submit`, show and reconfirm: - Account and profile. - Symbol and exchange. - Buy or sell side. - Quantity. - Order type and prices. - Time in force. - Estimated order value, commission, and margin effect. 5. Require the user to provide an explicit confirmation phrase for live submission rather than inferring consent from an earlier request. 6. Prefer limit orders over market orders in examples involving live trading, unless the user deliberately requests a market order. 7. Add a persistent visual warning to every documented live-profile example, while keeping paper-profile examples as the primary onboarding workflow. 8. For multi-account setups, require an explicit `--account` value and confirmation before live submission. ]]>

T08 · Insecure Dependencies

Warning

Location: references/setup.md:36
Finding: Unpinned Installation and Upgrade of a Brokerage-Capable Dependency
Content: View full analysis
Remediation: View remediation
" ``` 2. Publish and verify cryptographic hashes for approved artifacts. For pip-based installation, use a reviewed requirements file with `--require-hashes`. 3. Document the authoritative package publisher, project URL, source repository, and expected package index. 4. Prefer signed releases or attestations and explain how users can verify them before installation. 5. Avoid recommending an unconditional `ibkr update` as the first troubleshooting action. Require review of release notes, version changes, and artifact provenance. 6. Keep automatic update behavior limited to notification. Do not permit unattended installation of newer versions. 7. Test new versions in a paper-trading environment before authorizing use with a live brokerage profile. 8. Run the CLI as an unprivileged operating-system user and never install it with administrator or root privileges. 9. Restrict local Gateway or TWS API access to trusted clients and configure broker-side API protections where available. 10. Maintain an approved-version policy with a rollback procedure for compromised or defective releases. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The examples rely on common phrasing that may appear in harmless informational requests, such as wanting stock news, options data, or company financials, without making clear that this skill is for Interactive Brokers operations. In practice this increases accidental invocation and may expose users to trading-oriented guidance when they only wanted general market information.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly guides inexperienced users from setup through executing trades, but it does not provide an upfront warning that actions may affect a real brokerage account or involve financial loss. In a trading context, the absence of clear safety messaging materially increases the chance of users misunderstanding whether they are operating in live or paper mode before following actionable commands.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill instructs the agent to prefer live profiles over paper by default and to test live connectivity first unless the user explicitly mentions paper. In a brokerage/trading skill, defaulting toward production systems without affirmative opt-in is highly dangerous because it can normalize or accelerate real-account interactions and increase the risk of unintended live trading or disclosure of live account data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The examples rely on common phrasing that may appear in harmless informational requests, such as wanting stock news, options data, or company financials, without making clear that this skill is for Interactive Brokers operations. In practice this increases accidental invocation and may expose users to trading-oriented guidance when they only wanted general market information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The setup guidance explicitly prioritizes testing gateway-live and live before paper profiles when the user has not specified a preference. In a brokerage/trading skill, steering users toward live connectivity by default increases the chance that subsequent commands are run against a real account, which can lead to unintended live orders, exposure of real account data, or other irreversible financial actions.
Content: No source excerpt is available for this finding.