ibkr-cli

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:48 AM UTC
• Version: 1.0.1

Overview

This skill is a real brokerage CLI guide, but it defaults ambiguous setup to live Interactive Brokers profiles, which can expose real account data and set up later live trading by mistake.

Review carefully before installing. Use paper profiles by default, choose live profiles only with explicit intent, confirm the account before any order, preview every trade first, and avoid using this skill for general stock research unless you specifically want IBKR-backed commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: references/setup.md:27
• Finding: Unsafe Live-First Brokerage Profile Selection<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:31-32`; `references/setup.md:27-29` **Vulnerability Type**: Unsafe default configuration for real-money trading **Risk Level**: High ### Vulnerable Code Snippet From `SKILL.md:31-32`: ```markdown - **Connection priority**: Unless the user explicitly mentions "paper" or a paper account, prefer live profiles over paper, and gateway over TWS. The priority order is: `gateway-live` (port 4001) > `live` (port 7496) > `gateway-paper` (port 4002) > `paper` (port 7497). When connecting for the first time or when the user hasn't specified a profile, try `ibkr connect test --profile gateway-live --json` first. If it fails, try the next profile in the priority list. Once a working profile is found, use it for subsequent commands. - **Profile flag**: Most commands accept `--profile`. Always be explicit about which profile to use. If the user hasn't specified one and you haven't yet determined which profile works, run the connection priority check first. ``` From `references/setup.md:27-29`: ```markdown ### Choosing a profile When the user hasn't specified whether they want paper or live trading, verify connectivity in priority order: `gateway-live` (4001) > `live` (7496) > `gateway-paper` (4002) > `paper` (7497). Use `ibkr connect test --profile <name> --json` to check each. The first successful connection is the one to use. Only default to paper if the user explicitly says they want paper trading, or if no live connection is available. ``` ### Technical Analysis The Skill directs the Agent to probe and select live brokerage profiles before paper profiles when the user has not explicitly selected an environment. This violates the fail-safe-default principle because an ambiguous request is resolved in favor of the environment capable of executing real-money transactions. The trading guide does require either `--preview` or `--submit` and recommends previewing orders first. That control reduces accident ...[truncated 1943 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make paper trading the default whenever the user has not explicitly selected an environment: ```text gateway-paper > paper ``` 2. Do not automatically fall back from paper to live. Treat live selection as a separate, explicit user decision. 3. Before connecting to a live profile, obtain contemporaneous confirmation that clearly states: - The profile name. - Whether the environment is live. - The target account or masked account identifier. 4. Before every live `--submit`, show and reconfirm: - Account and profile. - Symbol and exchange. - Buy or sell side. - Quantity. - Order type and prices. - Time in force. - Estimated order value, commission, and margin effect. 5. Require the user to provide an explicit confirmation phrase for live submission rather than inferring consent from an earlier request. 6. Prefer limit orders over market orders in examples involving live trading, unless the user deliberately requests a market order. 7. Add a persistent visual warning to every documented live-profile example, while keeping paper-profile examples as the primary onboarding workflow. 8. For multi-account setups, require an explicit `--account` value and confirmation before live submission. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/setup.md:36
• Finding: Unpinned Installation and Upgrade of a Brokerage-Capable Dependency<![CDATA[ ## Vulnerability Details **File Location**: `references/setup.md:36-46`; `references/account.md:31-39` **Vulnerability Type**: Unpinned third-party package installation and upgrade **Risk Level**: Medium ### Vulnerable Code Snippet From `references/setup.md:36-46`: ```markdown Recommended installation via pipx (isolated environment, won't interfere with other Python packages): ```bash pipx install ibkr-cli ``` Alternative via pip: ```bash python -m pip install ibkr-cli ``` ``` From `references/account.md:31-39`: ```markdown ## Updating The CLI checks for new versions automatically once a day and prints a hint if an update is available. To upgrade: ```bash ibkr update ``` This detects whether the user installed via pipx or pip and runs the appropriate upgrade command. If the user reports issues that may be version-related, suggest running `ibkr update` first. ``` ### Technical Analysis The installation commands request the latest package release from the configured Python package index without pinning an audited version or validating an integrity hash. The update command similarly delegates selection and installation of a newer release to the installed CLI. Package isolation through `pipx` reduces dependency conflicts but does not establish package authenticity or integrity. An isolated environment can still execute malicious package installation hooks and runtime code with the invoking user’s operating-system permissions. No evidence was found that the current `ibkr-cli` package is malicious. The vulnerability is the absence of supply-chain controls in guidance for a tool with access to a brokerage API. If the package publisher, package-index account, release infrastructure, name resolution, or configured package source were compromised, users following these instructions could install attacker-controlled code. ### Attack Path 1. An attacker compromises the package publisher, release process, package-index account, or a package sourc ...[truncated 1577 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin installation instructions to a specifically reviewed version: ```bash pipx install "ibkr-cli==<reviewed-version>" ``` 2. Publish and verify cryptographic hashes for approved artifacts. For pip-based installation, use a reviewed requirements file with `--require-hashes`. 3. Document the authoritative package publisher, project URL, source repository, and expected package index. 4. Prefer signed releases or attestations and explain how users can verify them before installation. 5. Avoid recommending an unconditional `ibkr update` as the first troubleshooting action. Require review of release notes, version changes, and artifact provenance. 6. Keep automatic update behavior limited to notification. Do not permit unattended installation of newer versions. 7. Test new versions in a paper-trading environment before authorizing use with a live brokerage profile. 8. Run the CLI as an unprivileged operating-system user and never install it with administrator or root privileges. 9. Restrict local Gateway or TWS API access to trusted clients and configure broker-side API protections where available. 10. Maintain an approved-version policy with a rollback procedure for compromised or defective releases. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The examples rely on common phrasing that may appear in harmless informational requests, such as wanting stock news, options data, or company financials, without making clear that this skill is for Interactive Brokers operations. In practice this increases accidental invocation and may expose users to trading-oriented guidance when they only wanted general market information.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill explicitly guides inexperienced users from setup through executing trades, but it does not provide an upfront warning that actions may affect a real brokerage account or involve financial loss. In a trading context, the absence of clear safety messaging materially increases the chance of users misunderstanding whether they are operating in live or paper mode before following actionable commands.

Natural-Language Policy Violations

High

• Confidence: 99% confidence
• Finding: The skill instructs the agent to prefer live profiles over paper by default and to test live connectivity first unless the user explicitly mentions paper. In a brokerage/trading skill, defaulting toward production systems without affirmative opt-in is highly dangerous because it can normalize or accelerate real-account interactions and increase the risk of unintended live trading or disclosure of live account data.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The examples rely on common phrasing that may appear in harmless informational requests, such as wanting stock news, options data, or company financials, without making clear that this skill is for Interactive Brokers operations. In practice this increases accidental invocation and may expose users to trading-oriented guidance when they only wanted general market information.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The setup guidance explicitly prioritizes testing `gateway-live` and `live` before paper profiles when the user has not specified a preference. In a brokerage/trading skill, steering users toward live connectivity by default increases the chance that subsequent commands are run against a real account, which can lead to unintended live orders, exposure of real account data, or other irreversible financial actions.

Static analysis

No suspicious patterns detected.