Security audit

Connectors Available

Security checks for vulnerabilities and agentic risk

Overview

This skill has a legitimate connector-checking purpose, but its scripts handle trading API credentials and user input unsafely enough to require review before installation.

Review before installing. Use only with a local Hummingbot API you control, replace admin/admin with unique credentials, avoid remote HTTP endpoints, do not run it in directories containing untrusted .env files, and avoid passing untrusted token or data-file strings to search_token.sh. Expect test_all.sh to write data/trading_rules.json or a chosen output path.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/search_token.sh:29
Finding: Arbitrary Python Code Execution Through Shell-Expanded Heredoc
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/test_all.sh:8
Finding: Arbitrary Shell Execution Through Sourcing of Broadly Located Environment Files
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/test_all.sh:15
Finding: Basic Authentication Credentials Can Be Sent to an Unrestricted Plaintext Endpoint
Content: View full analysis
&1) ``` From `scripts/test_connector.sh`: ```bash API_URL="${HUMMINGBOT_API_URL:-http://localhost:8000}" API_USER="${API_USER:-admin}" API_PASS="${API_PASS:-admin}" TIMEOUT=10 ``` ```bash result=$(curl -s -u "$API_USER:$API_PASS" --max-time "$TIMEOUT" \ "$API_URL/connectors/$CONNECTOR/trading-rules" 2>&1) ``` ### Technical Analysis HTTP Basic authentication only encodes credentials; it does not encrypt them. When the configured endpoint uses HTTP, anyone able to observe the traffic can recover the username and password. Although the default destination is loopback, `HUMMINGBOT_API_URL` can specify any destination and either HTTP or HTTPS. The scripts do not enforce loopback use, validate the scheme, restrict the destination, or request confirmation before transmitting credentials to a remote host. In `test_all.sh`, authentication options are also assembled into a scalar and expanded without quotes: ```bash AUTH="-u $API_USER:$API_PASS" curl -s $AUTH ... ``` Whitespace or curl-option syntax in credential values can therefore alter argument parsing. This expands the risk beyond credential disclosure because malicious configuration can inject additional curl options. Network access is necessary for the ...[truncated 1623 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/test_all.sh:15
Finding: Predictable Administrative Default Credentials
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill description omits important operational behavior: it relies on authenticated local API access and local environment credentials. That mismatch can mislead users into approving a seemingly harmless lookup skill when it actually performs authenticated local actions, increasing the chance of unintended credential use or local system interaction.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill description omits important operational behavior: it relies on authenticated local API access and local environment credentials. That mismatch can mislead users into approving a seemingly harmless lookup skill when it actually performs authenticated local actions, increasing the chance of unintended credential use or local system interaction.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.
md
Fetches trading rules from each connector. If data returns, it's accessible. Results saved to `data/trading_rules.json`.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.
md
Fetches trading rules from each connector. If data returns, it's accessible. Results saved to `data/trading_rules.json`.

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: Accessing .env files to retrieve credentials is a real security concern here because the script consumes secrets from multiple local locations automatically. In addition, using source on a .env file allows arbitrary shell execution if the file contents are malicious, turning credential access into potential code execution.
Content: Scanner excerpt · scripts/test_all.sh (reported line 7)May include surrounding context.
sh
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" # Load .env if present for f in hummingbot-api/.env ~/.hummingbot/.env .env; do if [ -f "$f" ]; then set -a; source "$f"; set +a

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: This specific instance continues the same risky behavior: iterating through candidate .env paths and sourcing the first match. That behavior can unintentionally pull secrets from the user's home directory or project tree and execute attacker-controlled shell content if any discovered file is unsafe.
Content: Scanner excerpt · scripts/test_all.sh (reported line 8)May include surrounding context.
sh
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" # Load .env if present for f in hummingbot-api/.env ~/.hummingbot/.env .env; do if [ -f "$f" ]; then set -a; source "$f"; set +a break

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/test_all.sh (reported line 38)May include surrounding context.
sh
# Get all connectors if not specified if [[ -z "$CONNECTORS" ]]; then CONNECTORS=$(curl -s $AUTH "$API_URL/connectors/" | python3 -c "import sys,json; print(','.join(json.load(sys.stdin)))") fi echo ""

Credential Access

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: This finding reflects credential access behavior: the script inspects and sources local .env files that commonly contain API secrets. In addition to unnecessary secret access for the stated task, sourcing the file as shell code means a poisoned .env can lead to arbitrary command execution and secret exposure.
Content: Scanner excerpt · scripts/test_connector.sh (reported line 5)May include surrounding context.
sh
# Test if a connector is accessible from current location # Usage: ./test_connector.sh --connector <name> [--timeout 10] # Load .env if present for f in hummingbot-api/.env ~/.hummingbot/.env .env; do if [ -f "$f" ]; then set -a; source "$f"; set +a

Credential Access

High

Category: Privilege Escalation
Confidence: 89% confidence
Finding: The explicit search through multiple standard .env locations broadens the credential-access surface and makes the behavior more intrusive than the skill description suggests. In this context, silently probing for local secret files is particularly concerning because the task is framed as a simple availability/trading-rules check, not credentialed secret handling.
Content: Scanner excerpt · scripts/test_connector.sh (reported line 6)May include surrounding context.
sh
# Usage: ./test_connector.sh --connector <name> [--timeout 10] # Load .env if present for f in hummingbot-api/.env ~/.hummingbot/.env .env; do if [ -f "$f" ]; then set -a; source "$f"; set +a break

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill invokes shell scripts but does not declare any tool restrictions or allowed tools, which weakens containment and reviewability. In an agent setting, undeclared shell capability increases the risk that the skill will execute local commands or access files in ways the user did not explicitly authorize.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs use of default admin/admin credentials and encourages loading secrets from .env locations without strong security guidance. This is dangerous because weak default credentials on a local trading API can enable unauthorized access to trading-related functionality or leakage of sensitive account configuration if the host is exposed or shared.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest says the skill checks which exchanges work from a location and searches for tokens with trading rules, implying a crypto-token focused scope. This data file includes many non-token instruments such as stock-like symbols (for example AAPLX-USDT, MSFT-USDT), commodities (XAU-USDT, XAG-USDT), indices (SPX500-USDT, NAS100-USDT), and forex-style pairs (EUR-USDT, JPY-USDT), which broadens the effective behavior beyond the stated purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This JSON manifest includes a market key named "币安人生-USDT", which is natural-language content in Chinese embedded directly in the skill data. The file provides no indication that Chinese-language naming is optional, user-selected, or justified by a region-specific scope, so it can violate the stated language/locale policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The market entry "我踏马来了-USDT" contains Chinese natural-language text rather than a locale-neutral code. Because the file does not offer language choice or explain a Chinese-only regional context, this constitutes a language/locale policy concern under the natural-language policy rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The instrument key "踏马的没房-USDT" contains Chinese natural-language wording in the data set. There is no surrounding documentation indicating that users opted into Chinese localization or that the file is intended only for a Chinese-language audience, so this may violate the organizational language/locale policy.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script automatically sources local and home-directory .env files, importing secrets and configuration that are not necessary for a simple availability/trading-rules lookup unless the user explicitly opted in. Because Bash source executes shell syntax, a malicious or tampered .env file could also run arbitrary commands in the user's context, making this more than passive configuration loading.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script silently loads API credentials from .env files and uses them for authenticated requests without a prominent warning or consent step. In the context of a skill described as checking exchange availability and trading rules, implicit credential use expands scope and can surprise users who would reasonably expect unauthenticated metadata queries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script makes authenticated network requests and writes the returned data to disk without explicit user-facing disclosure of those side effects. While saving trading rules is aligned with the stated function, the combination of network activity, credential use, and local persistence can leak sensitive operational details or produce unintended artifacts in shared environments.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script sources local .env files and imports all variables into the environment before performing a simple connector-availability check. This exceeds the stated purpose and creates unnecessary access to secrets; additionally, sourcing a .env as shell code is dangerous because a maliciously modified file can execute commands in the user's shell context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script silently loads credentials from common local .env locations without informing the user. Even if intended for convenience, this is risky because users may not expect a location-checking utility to access secrets, and the sourcing mechanism can also execute arbitrary shell content from those files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script sends credentials via curl using basic authentication without visible user disclosure, and it defaults to admin/admin if variables are absent. In the skill context, a user may think they are only checking connector availability, but the script may authenticate to an API endpoint and expose credentials to a misconfigured or non-local service, especially if API_URL is overridden.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill writes results to data/trading_rules.json without warning that it may create or overwrite a local file. Silent filesystem writes are risky in agent workflows because they can unexpectedly modify user data, interfere with existing files, or leave behind sensitive exchange metadata.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.