Security audit
Security checks for vulnerabilities and agentic risk
This trading-bot skill is mostly coherent about its purpose, but its optional platform and live-trading features handle API credentials and automated orders with weak safeguards.
Install only if you are comfortable with a trading skill that can store platform credentials locally, upload strategy/backtest data to the configured platform, and run automated leveraged BTCUSDT trading. Before using bind or live mode, avoid shared credential paths, restrict file permissions yourself, verify the platform URL is exactly the intended HTTPS origin, and treat any api_secret printed by this version as compromised and rotate it.
scripts/live_trade.py:70Binding API Secret Disclosed in Plaintext Output
scripts/live_trade.py:84Credential File Created Without Enforced Restrictive Permissions
scripts/trading_client.py:33Authenticated Requests Can Be Sent to Arbitrary or Plaintext Origins
scripts/requirements.txt:1Open-Ended Dependency Versions Make Builds Non-Reproducible
If the actual implemented behavior is limited to packaging and uploading verification artifacts plus reading local credentials, then the skill description is still materially incomplete about outbound data transfer and credential use. In this context, understated upload behavior is risky because trading results, strategy parameters, and local secrets may be sent to a remote platform users did not realize was involved.
If the actual implemented behavior is limited to packaging and uploading verification artifacts plus reading local credentials, then the skill description is still materially incomplete about outbound data transfer and credential use. In this context, understated upload behavior is risky because trading results, strategy parameters, and local secrets may be sent to a remote platform users did not realize was involved.
If the actual implemented behavior is limited to packaging and uploading verification artifacts plus reading local credentials, then the skill description is still materially incomplete about outbound data transfer and credential use. In this context, understated upload behavior is risky because trading results, strategy parameters, and local secrets may be sent to a remote platform users did not realize was involved.
If the actual implemented behavior is limited to packaging and uploading verification artifacts plus reading local credentials, then the skill description is still materially incomplete about outbound data transfer and credential use. In this context, understated upload behavior is risky because trading results, strategy parameters, and local secrets may be sent to a remote platform users did not realize was involved.
If the actual implemented behavior is limited to packaging and uploading verification artifacts plus reading local credentials, then the skill description is still materially incomplete about outbound data transfer and credential use. In this context, understated upload behavior is risky because trading results, strategy parameters, and local secrets may be sent to a remote platform users did not realize was involved.
If the actual implemented behavior is limited to packaging and uploading verification artifacts plus reading local credentials, then the skill description is still materially incomplete about outbound data transfer and credential use. In this context, understated upload behavior is risky because trading results, strategy parameters, and local secrets may be sent to a remote platform users did not realize was involved.
If the actual implemented behavior is limited to packaging and uploading verification artifacts plus reading local credentials, then the skill description is still materially incomplete about outbound data transfer and credential use. In this context, understated upload behavior is risky because trading results, strategy parameters, and local secrets may be sent to a remote platform users did not realize was involved.
The CLI includes direct position-opening and position-closing commands that can place leveraged long/short trades against an external platform. Because these actions are not prominently reflected in the stated skill scope, an operator or agent could trigger irreversible financial actions without understanding they are live, not local backtests.
The order commands execute leveraged live trades immediately with no confirmation prompt, no dry-run default, and no explicit warning about real financial consequences. In the context of an agent skill that may be driven by natural-language instructions, this sharply increases the risk of accidental or coerced destructive trading activity.
The skill advertises and instructs use of shell execution, file reads/writes, and optional external network access, yet it declares no explicit tool scope or permission boundaries. In a trading skill that handles local credential files and can contact remote platforms, missing least-privilege controls increases the chance of unintended command execution, data exposure, or misuse of networked actions.
The skill requires generating name_i18n / personality_i18n / description_i18n with both zh and en, and explicitly instructs the agent to produce English whenever the user's original description is mainly Chinese. This imposes a language policy on outputs rather than offering a user choice or opt-in.
This documentation gives concrete leverage, position sizing, and stop-loss guidance for highly leveraged crypto trading without any prominent warning about liquidation, amplified losses, slippage, or the possibility of losing most or all capital. In the context of a skill that automatically creates and can validate/simulate trading bots, this omission can normalize unsafe risk-taking and lead users to deploy dangerous configurations with misplaced confidence.
The text recommends enabling rolling positions as a 'profit amplifier' and states trend strategies 'strongly' should enable it, but does not warn that pyramiding into winning positions increases exposure, can magnify reversals, and may turn unrealized gains into larger realized losses. In an automated bot-creation context, such one-sided guidance can push users toward systematically riskier behavior without understanding compounding downside.
The skill instructs saving long-lived API credentials in a predictable location under the user’s home directory and reusing them for later upload and live trading actions. Persistent storage of trading secrets increases the blast radius of local compromise, accidental disclosure, backup leakage, or multi-user host access, especially because those credentials can authorize remote trading operations.
mkdir -p ~/.moss-trade-bot
cd {baseDir}/scripts && python3 live_trade.py bind \
--platform-url "https://ai.moss.site" \
--pair-code "<pair_code>" \
These lines require bot metadata to include both zh and en fields and state the script will reject uploads if English is not provided. This imposes a specific language policy on users without opt-in or documented justification tied to locale-specific compliance. Under the natural-language policy rule, forcing a language/locale choice without user choice is a policy concern.
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
ls -la ~/.moss-trade-bot/agent_creds.json 2>/dev/null || true
# 如需确认平台地址是否已保存到本地 creds，可读取 base_url：
python3 - <<'PY'
import json, pathlib
The skill authorizes starting automatic live trading when the user says a broad phrase like “启动自动交易”, and explicitly says no per-trade confirmation is needed. In a high-risk financial context, this can trigger real market actions without a fresh, explicit activation-time warning, amount/leverage recap, or stronger confirmation step, increasing the chance of accidental or socially engineered execution.
This code file contains natural-language documentation entirely in Chinese, including the top-level module docstring and many inline comments, but provides no indication that Chinese is optional or that the skill is region-specific. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in is a natural-language policy concern.
The top-level docstring is entirely in Chinese and presents the skill's operational constraints only in that language. This creates a language/locale policy concern because users are not given an opt-in choice or an alternative language, and no region-specific justification is stated in the file.
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
if use_cache and os.path.exists(cache_file):
mod_time = os.path.getmtime(cache_file)
if time.time() - mod_time < 86400:
print(f"Using cached file: {os.path.basename(cache_file)}", file=__import__('sys').stderr)
return pd.read_csv(cache_file, parse_dates=["timestamp"])
if not since_date:
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
matches = sorted(glob.glob(pattern), key=os.path.getmtime, reverse=True)
if matches:
best = matches[0]
print(f"Using cached file: {os.path.basename(best)}", file=__import__('sys').stderr)
return pd.read_csv(best, parse_dates=["timestamp"])
exchange = get_exchange(exchange_id)
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
# 缓存
df.to_csv(cache_file, index=False)
print(f"Fetched {len(df)} candles for {symbol} {timeframe}, cached to {cache_file}", file=__import__('sys').stderr)
return df
The file contains user-facing descriptive text in Chinese only, while the rest of the script is otherwise usable broadly. This imposes a specific language on users without opt-in or an alternative locale, matching the language/locale policy violation criteria.
The file exposes live trading and credential-binding workflows even though the skill is primarily framed around local backtesting and optional external validation. This creates a dangerous capability mismatch: a user or downstream agent may invoke real-money operations under the assumption that the skill is simulation-only, increasing the chance of unintended financial loss.
The script writes API credentials, including the API secret, to a JSON file on disk without enforcing secure permissions or warning that the file contains highly sensitive trading credentials. If the file is exposed through weak filesystem permissions, backups, logs, or multi-user environments, an attacker could take over the linked trading account and place unauthorized trades.
No suspicious patterns detected.