Hummingbot Deploy

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:30 AM UTC
• Version: 1.0.0

Overview

The skill is for Hummingbot deployment, but it asks users to run mutable remote shell code and uses weak plaintext defaults for trading-related services.

Review carefully before installing. Use only pinned, reviewed scripts and container images; replace all default credentials with strong unique values; avoid exposing the API beyond trusted hosts; do not create the sudo shim; and verify where agent MCP configuration stores API credentials.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:35

Finding

Unpinned Remote Scripts Are Downloaded and Executed Directly

Content

View full analysis

--user --pass ``` ```bash bash <(curl -s https://raw.githubusercontent.com/hummingbot/skills/main/skills/hummingbot-deploy/scripts/install_mcp.sh) \ --agent claude --user admin --pass admin ``` ```bash bash <(curl -s https://raw.githubusercontent.com/hummingbot/skills/main/skills/hummingbot-deploy/scripts/verify.sh) ``` ### Technical Analysis The instructions stream shell scripts from the mutable `main` branch of a remote GitHub repository directly into Bash. No immutable commit reference, checksum, signature, or local review is required before execution. Consequently, the effective code executed by the Skill can change after this package has been reviewed. The project already contains local copies of these scripts, so remote retrieval is not necessary for the declared deployment functionality. The MCP installation command is especially sensitive because API credentials are supplied as arguments to code retrieved from the network. If the upstream repository, account, branch, DNS path, or delivery infrastructure is compromised, the replacement script could read those arguments and execute arbitrary commands. ### Attack Path 1. An attacker compromises the upstream repository, maintainer account, or mutable `main` branch. 2. The attacker replaces one of the referenced scripts with a malicious payload. 3. A user or AI agent follows the instructions in `SKILL.md`. 4. `curl` retrieves the changed payload and process substitution ...[truncated 871 chars]

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:61

Finding

Installation Creates a Global Fake sudo Executable

Content

View full analysis

/dev/null && echo -e '#!/bin/bash\nwhile [[ "$1" == *=* ]]; do export "$1"; shift; done\nexec "$@"' > /usr/local/bin/sudo && chmod +x /usr/local/bin/sudo ``` ### Technical Analysis When executed as root in an environment without `sudo`, the installation instructions create `/usr/local/bin/sudo`. This program does not implement sudo's authentication, authorization, user-selection, policy, logging, or environment-sanitization behavior. Instead, it exports leading assignment arguments and directly executes the remaining command. Creating a globally discoverable executable under the trusted name `sudo` affects unrelated programs after the deployment step finishes. Programs may detect it with `command -v sudo` and incorrectly assume that genuine sudo security semantics are available. The deployment task does not require replacing a system administration tool. Because the condition requires the current process to already be root, commands can be invoked directly without installing a spoofed `sudo`. ### Attack Path 1. The Skill runs as root in a container or other environment where genuine `sudo` is absent. 2. The command writes the shim to `/usr/local/bin/sudo` and makes it executable. 3. `/usr/local/bin` remains in the command search path after installation. 4. A later installer or administrative script checks for and invokes `sudo`. 5. The shim executes the supplied command directly as the already privileged user, without expected sudo policy enforcement or environment handling. 6. Attacker-influenced arguments or environment variables accepted by the later script may consequently be processed with root privileges. ### Impact Assessment The direct effect is a persistent ...[truncated 500 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/verify.sh:8

Finding

Verification Executes Dotenv Files as Arbitrary Shell Code

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:67

Finding

Predictable Default Credentials Are Persisted in Plaintext Configuration

Content

View full analysis

.env << EOF API_USER=admin API_PASS=admin CONFIG_API_PASS=admin DEBUG_MODE=false BROKER_HOST=hummingbot-broker BROKER_PORT=1883 BROKER_API_USER=admin BROKER_PASSWORD=password DATABASE_URL=postgresql+asyncpg://hbot:hummingbot-api@hummingbot-postgres:5432/hummingbot_api BOTS_PATH=/hummingbot-api/bots EOF ``` From `scripts/install_mcp.sh`: ```bash API_URL=$(get_docker_host_url) API_USER="admin" API_PASS="admin" AGENT_CLI="" MCP_IMAGE="hummingbot/hummingbot-mcp:latest" ``` ```bash # Build the docker command DOCKER_CMD="docker run --rm -i -e HUMMINGBOT_API_URL=$API_URL -e HUMMINGBOT_API_USERNAME=$API_USER -e HUMMINGBOT_API_PASSWORD=$API_PASS -v hummingbot_mcp:/root/.hummingbot_mcp $MCP_IMAGE" # Different CLIs have slightly different syntax case "$AGENT_CLI" in gemini) # Gemini: gemini mcp add [args...] $AGENT_CLI mcp add hummingbot $DOCKER_CMD ;; *) # Claude/Codex: mcp add -- [args...] $AGENT_CLI mcp add hummingbot -- $DOCKER_CMD ;; esac ``` ### Technical Analysis The noninteractive installation writes publicly known credentials, including `admin/admin` and broker password `password`, to a plaintext `.env` file. These values are not randomly generated and no mandatory rotation is performed. The MCP installer independently defaults to `admin/admin`. It interpolates the password into a Docker command that is passed to an agent CLI for persistent MCP registration. Depending on the CLI implementation, this complete command can be stored in an agent configura ...[truncated 1701 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The declared description is broader than what this code chunk actually does. The script does support Hummingbot setup in a limited sense, but only for MCP server access through external agent CLIs such as Claude, Gemini, or Codex. It validates the CLI, pulls the hummingbot/hummingbot-mcp Docker image, and configures the CLI to launch that container with API connection environment variables. There is no code here to deploy the Hummingbot API server itself, no setup of a Condor Telegram bot, and no general infrastructure provisioning. Because the declared purpose describes a more comprehensive deployment capability than this script provides, this is a material description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly uses default credentials like admin/admin/admin for API and config access and does not prominently warn that these are insecure and must be changed. In deployment context, especially for network-exposed services and bot infrastructure, default credentials can lead to immediate unauthorized access and account compromise.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The skill writes plaintext credentials directly into a .env file, including API and broker passwords, using insecure hardcoded defaults. Storing secrets this way is dangerous because .env files are easily leaked through backups, logs, shell history, accidental commits, or over-broad file permissions.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md

export USER=${USER:-root}
[ "$(id -u)" = "0" ] && ! command -v sudo &>/dev/null && echo -e '#!/bin/bash\nwhile [[ "$1" == *=* ]]; do export "$1"; shift; done\nexec "$@"' > /usr/local/bin/sudo && chmod +x /usr/local/bin/sudo

# Create .env manually (skip interactive setup)
# Note: In containers, services communicate via Docker network (use container names, not localhost)
cat > .env << EOF
API_USER=admin

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The specific values shown (API_PASS=admin, CONFIG_API_PASS=admin) normalize deployment with trivially guessable credentials and encourage insecure copy-paste behavior. Because this is trading infrastructure that may expose control interfaces, compromise could allow unauthorized bot management, data access, or service abuse.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

# Create .env manually (skip interactive setup)
# Note: In containers, services communicate via Docker network (use container names, not localhost)
cat > .env << EOF
API_USER=admin
API_PASS=admin
CONFIG_API_PASS=admin

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 84% confidence

Finding

The command chains docker compose down -v with rm -rf ./hummingbot-api, so a single execution performs multiple destructive actions without pause or validation. Chaining amplifies operator mistakes and can increase damage if the working directory or path assumptions are wrong.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

cd ./hummingbot-api && docker compose logs -f

Reset

cd ./hummingbot-api && docker compose down -v && rm -rf ./hummingbot-api

text

## See Also

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The script sources the first matching .env file directly into the current shell using source, which executes arbitrary shell code, not just variable assignments. If an attacker can modify any of these files or influence the working directory, running this verification script can trigger unintended command execution and expose secrets via exported environment variables.

Content

Scanner excerpt · scripts/verify.sh (reported line 8)May include surrounding context.

sh

#
set -eu

# Load .env if present
for f in hummingbot-api/.env ~/.hummingbot/.env .env; do
    if [ -f "$f" ]; then
        set -a; source "$f"; set +a

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

This finding is part of the same unsafe pattern: the script iterates through multiple candidate .env locations, including a relative .env, and sources the first one found. That expands the attack surface because a malicious repository-local or current-directory .env can be used for code execution when the verification script runs.

Content

Scanner excerpt · scripts/verify.sh (reported line 9)May include surrounding context.

sh

set -eu

# Load .env if present
for f in hummingbot-api/.env ~/.hummingbot/.env .env; do
    if [ -f "$f" ]; then
        set -a; source "$f"; set +a
        break

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill instructs the agent to run multiple shell commands, including remote script execution, git clone, Docker deployment, file edits, and destructive reset commands, but declares no explicit tool scope or allowed-tools restrictions. In a skill framework, this increases the chance of unintended or over-broad execution because consumers cannot easily constrain what the skill is permitted to do.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invocation text is broad enough to match generic install/setup/configuration requests, which can cause the skill to trigger in contexts where the user did not specifically request Hummingbot infrastructure deployment. Because the skill performs high-impact shell and Docker actions, over-triggering materially raises security and safety risk.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The skill contains logic intended for root execution and creates a sudo shim in /usr/local/bin when running as UID 0. Modifying a common system command path in this way can alter privilege semantics, mask the absence of real sudo, and create persistence or command-confusion risks in the environment.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

In containers (no TTY - check with [ -t 0 ] && echo "TTY" || echo "No TTY"):

bash

# Set USER env var and create sudo shim if needed
export USER=${USER:-root}
[ "$(id -u)" = "0" ] && ! command -v sudo &>/dev/null && echo -e '#!/bin/bash\nwhile [[ "$1" == *=* ]]; do export "$1"; shift; done\nexec "$@"' > /usr/local/bin/sudo && chmod +x /usr/local/bin/sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

This finding is tied to the same root-execution container block, where the skill proceeds with privileged environment modification and deployment after setting USER=root semantics and installing a sudo shim. In a deployment skill, performing filesystem and service setup as root without strict safeguards increases blast radius if anything in the chain is wrong or compromised.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

bash

# Set USER env var and create sudo shim if needed
export USER=${USER:-root}
[ "$(id -u)" = "0" ] && ! command -v sudo &>/dev/null && echo -e '#!/bin/bash\nwhile [[ "$1" == *=* ]]; do export "$1"; shift; done\nexec "$@"' > /usr/local/bin/sudo && chmod +x /usr/local/bin/sudo

# Create .env manually (skip interactive setup)
# Note: In containers, services communicate via Docker network (use container names, not localhost)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

Install the MCP server using your CLI's native command. Use the same credentials from API setup.

**IMPORTANT:** Do NOT ask the user which CLI to use. You already know which CLI you are:
- If you are Claude Code, use `claude`
- If you are Gemini CLI, use `gemini`
- If you are Codex CLI, use `codex`

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The instruction to run npx skills add hummingbot/skills does not pin a version or integrity value, so the executed package may change over time or be replaced upstream. This creates a supply-chain risk where future installs could pull unreviewed or malicious code into the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The script pulls a container image from a mutable latest tag, which allows the image contents to change over time without any script change or integrity guarantee. If the registry account or supply chain is compromised, users may install and trust a malicious MCP server image that will then receive API credentials and be registered with an agent CLI.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The docker run path also relies on the same mutable latest image reference, so execution is not reproducible and can silently shift to attacker-controlled code if the image is replaced upstream. In this skill context, that risk is amplified because the container is launched with Hummingbot API credentials in environment variables and is then integrated into an agent workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script embeds API credentials directly into a constructed Docker command and passes them to agent CLI configuration without warning, which can expose secrets through shell history, process listings, agent config/state, logs, or debugging output. In this deployment context, the risk is heightened because default credentials are weak (admin/admin) and the configured MCP server may persist access to a trading API backend.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The manifest describes installing and deploying Hummingbot components such as the API server, MCP server, and Telegram bot. This script goes further by modifying external AI agent CLI configuration through ' mcp add ...', which affects another tool's local setup rather than only deploying Hummingbot itself.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

cd ./hummingbot-api && docker compose logs -f

Reset

cd ./hummingbot-api && docker compose down -v && rm -rf ./hummingbot-api

text

## See Also

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The comments say the script should use 'host.docker.internal' on Mac/Windows and 'host-gateway' on Linux, implying different behavior by platform. However, both branches echo the identical URL, so the inline documentation contradicts the actual implementation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.