Security audit

Hummingbot Developer

Security checks for vulnerabilities and agentic risk

Overview

This skill appears intended for local Hummingbot development, but its installers and dev scripts use high-impact setup patterns that deserve manual review before installation.

Install only in an isolated development environment. Review scripts before running install-deps or install-all, avoid exposing the API, Gateway, Postgres, or EMQX ports beyond localhost, replace the default credentials immediately, and be especially cautious with the Docker installer and docker group change.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/install_deps.sh:62
Finding: Unverified remote installation scripts are executed directly
Content: View full analysis
/dev/null || true ``` ### Technical Analysis The script passes responses received from external URLs directly to command interpreters. This removes the opportunity to verify the downloaded content before execution. The Homebrew URL references mutable `HEAD`, so the effective payload can change after this Skill is reviewed. The nvm URL identifies a release tag, but the downloaded response is still not verified against a trusted checksum or signature. `get.docker.com` is also a mutable installer endpoint. HTTPS protects the connection in transit but does not protect against compromise of the hosting account, upstream repository, release process, DNS/TLS trust infrastructure, or the remote endpoint itself. If any source returns malicious content, that content executes immediately. The Docker installation path has especially high impact. Docker installation scripts commonly perform system package-management operations, and the script subsequently invokes `sudo usermod`. Membership in the Docker group is effectively root-equivalent on typical Linux systems because a member can start privileged containers and mount the host filesystem. These installation actions support the declared dependency-setup functionality, but direct remote-to-shell execution exceeds the min ...[truncated 1170 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/install_all.sh:156
Finding: Predictable plaintext service credentials are created without restrictive permissions
Content: View full analysis
"$API_DIR/.env" << EOF USERNAME=admin PASSWORD=admin CONFIG_PASSWORD=admin DEBUG_MODE=false # MQTT broker — EMQX running in Docker, exposed on localhost:1883 BROKER_HOST=localhost BROKER_PORT=1883 BROKER_USERNAME=admin BROKER_PASSWORD=password # Postgres — running in Docker, exposed on localhost:5432 # Note: Docker-based setup uses internal hostname 'hummingbot-postgres' — dev mode needs 'localhost' DATABASE_URL=postgresql+asyncpg://hbot:hummingbot-api@localhost:5432/hummingbot_api BOTS_PATH=$API_DIR/bots # Gateway — running from source on localhost:15888 GATEWAY_URL=http://localhost:15888 EOF touch "$API_DIR/.setup-complete" ok "Dev .env written (postgres + EMQX + gateway all on localhost)" ``` ### Technical Analysis The installer writes publicly predictable credentials for the API, configuration encryption, MQTT broker, and PostgreSQL database. It unconditionally replaces the existing `.env`, which can destroy previously secured configuration. No restrictive `umask` or explicit `chmod 600` is applied. Consequently, file accessibility depends on the user's ambient umask and directory permissions. On a multi-user system, other local users may be able to read the credentials. Although hostnames are set to `localhost`, actual exposure depends on the Docker Compose and application binding configuration in the external Hummingbot API repository. If ports are bound to non-loopback interfaces, accessed through a development proxy, or forwarded from a r ...[truncated 1410 chars]
Remediation: View remediation
"$API_DIR/.env" <

T09 · Insecure Skill Coding Practices

Error

Location: scripts/test_integration.py:26
Finding: API credentials can be sent to an attacker-controlled plaintext endpoint
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/select_branches.sh:137
Finding: Branch state is stored as executable shell code and later sourced
Content: View full analysis
"$WORKSPACE/.dev-branches" << EOF # Hummingbot dev branch selections # Generated: $(date -u +%Y-%m-%dT%H:%M:%SZ) HBOT_BRANCH=$HBOT_BRANCH GATEWAY_BRANCH=$GATEWAY_BRANCH API_BRANCH=$API_BRANCH EOF ``` The generated data file is subsequently interpreted as shell code: ```bash # Load saved branch selections if present if [ -f "$WORKSPACE/.dev-branches" ]; then source "$WORKSPACE/.dev-branches" echo "Loaded branch config from .dev-branches:" ``` ```bash # Load saved branch selections [ -f "$WORKSPACE/.dev-branches" ] && source "$WORKSPACE/.dev-branches" ``` ### Technical Analysis Branch values are serialized without shell escaping and then loaded using `source`. A sourced file is executable code, not data: command substitutions, separators, redirections, function definitions, and arbitrary commands in that file are interpreted by the current shell. The command-line branch path accepts values directly: ```bash --hummingbot) HBOT_BRANCH="$2"; shift 2 ;; --gateway) GATEWAY_BRANCH="$2"; shift 2 ;; --api) API_BRANCH="$2"; shift 2 ;; ``` When all three values are supplied, the script skips the interactive branch-list validation. Git operations may reject many malformed branch names, but using Git validation as shell-syntax validation is unsafe. More directly, any process or repository automation capable of modifying `$WORKSPACE/.dev-branches` can obtain command execution when a developer later runs installation, build, or verification. The state only needs to store three branch strings. Executing it as shell code is unnecessary and exceeds minimum privilege. ### Attack Pa ...[truncated 1169 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/install_deps.sh:99
Finding: Mutable and unpinned third-party dependency installers reduce supply-chain integrity
Content: View full analysis
/dev/null; then info "Installing pnpm via npm..." npm install -g pnpm export PATH="$(npm root -g)/.bin:$PATH" ok "pnpm $(pnpm --version) installed" ``` Repository-controlled lifecycle and installation commands are also executed: ```bash cd "$HBOT_DIR" make install ``` ```bash cd "$GATEWAY_DIR" step "pnpm install" pnpm install 2>&1 | tail -5 step "pnpm build (TypeScript → dist/)" pnpm build 2>&1 | tail -5 step "Gateway setup (non-interactive defaults)" pnpm run setup:with-defaults 2>&1 | grep -E "✓|✗|Error|conf|cert" | head -10 || true ``` ### Technical Analysis The Miniconda installer uses mutable `latest` URLs and executes a predictable temporary file without checksum or signature validation. The predictable path `/tmp/miniconda_install.sh` also creates an avoidable local race and symlink risk on systems where another user can manipulate the path. `npm install -g pnpm` installs whichever version is cur ...[truncated 1851 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (54)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 670)May include surrounding context.
Step 3: Confirm local hummingbot is in use

bash
curl -s http://localhost:8000/health | python3 -m json.tool

Check API logs for hummingbot version on startup.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/check_api.sh (reported line 13)May include surrounding context.
sh
API_URL="${HUMMINGBOT_API_URL:-http://localhost:8000}" if curl -s --max-time 3 "$API_URL/health" &>/dev/null; then RUNNING=true DETAIL=$(curl -s --max-time 3 "$API_URL/health" 2>/dev/null) else

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: The script writes predictable credentials directly into the .env file: USERNAME=admin, PASSWORD=admin, and CONFIG_PASSWORD=admin. If the API, broker, or related services are reachable beyond the local machine, these defaults make compromise trivial; even in local development, they normalize insecure secrets and can be accidentally reused or committed.
Content: Scanner excerpt · scripts/install_all.sh (reported line 160)May include surrounding context.
sh
# Always write the dev .env so DATABASE_URL and BROKER_HOST point to localhost. # The Docker-based setup writes internal hostnames (hummingbot-postgres, emqx) # which break when running the API from source outside of Docker. cat > "$API_DIR/.env" << EOF USERNAME=admin PASSWORD=admin CONFIG_PASSWORD=admin

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The curl-to-bash chain removes any review boundary between retrieval and execution, making exploitation trivial if the fetched content is malicious. This is a classic command-chaining anti-pattern and directly increases the blast radius of any supply-chain or transport compromise.
Content: Scanner excerpt · scripts/install_deps.sh (reported line 178)May include surrounding context.
sh
# Install nvm then node info "Installing nvm first..." curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash export NVM_DIR="$HOME/.nvm" [ -s "$NVM_DIR/nvm.sh" ] && source "$NVM_DIR/nvm.sh" nvm install 22

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The Docker installation path on Linux downloads a remote script and pipes it into sh, then adjusts local privileges via docker group membership. This is especially dangerous because Docker installation typically requires elevated changes, so a compromised installer can make broad system modifications or establish persistence.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The curl-to-sh chain for Docker is especially severe because it targets system-level installation and often runs commands that require or lead to elevated privileges. A malicious or tampered response would be executed immediately with no opportunity for validation, enabling full host compromise.
Content: Scanner excerpt · scripts/install_deps.sh (reported line 261)May include surrounding context.
sh
fi elif [ "$OS" = "Linux" ]; then info "Installing Docker Engine..." curl -fsSL https://get.docker.com | sh sudo usermod -aG docker "$USER" 2>/dev/null || true ok "Docker installed — log out and back in for group membership" INSTALLED+=("docker")

Credential Access

High

Category: Privilege Escalation
Confidence: 91% confidence
Finding: The script falls back to hardcoded default credentials ('admin'/'admin') for authenticated API access. In a developer stack this may seem convenient, but if the API is exposed beyond localhost or reused in less controlled environments, predictable credentials can allow unauthorized access to API and gateway-related endpoints.
Content: Scanner excerpt · scripts/test_integration.py (reported line 31)May include surrounding context.
python
API_USER = os.environ.get("API_USER") or os.environ.get("API_USER", "admin") API_PASS = os.environ.get("API_PASS") or os.environ.get("API_PASS", "admin") # Load .env file (first match wins) _ENV_PATHS = [ "hummingbot-api/.env", os.path.expanduser("~/.hummingbot/.env"),

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/test_integration.py (reported line 33)May include surrounding context.
python
# Load .env file (first match wins) _ENV_PATHS = [ "hummingbot-api/.env", os.path.expanduser("~/.hummingbot/.env"), ".env", ]

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/test_integration.py (reported line 34)May include surrounding context.
python
# Load .env file (first match wins) _ENV_PATHS = [ "hummingbot-api/.env", os.path.expanduser("~/.hummingbot/.env"), ".env", ]

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/test_integration.py (reported line 35)May include surrounding context.
python
# Load .env file (first match wins) _ENV_PATHS = [ "hummingbot-api/.env", os.path.expanduser("~/.hummingbot/.env"), ".env", ]

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/test_integration.py (reported line 124)May include surrounding context.
python
# Load .env file (first match wins) _ENV_PATHS = [ "hummingbot-api/.env", os.path.expanduser("~/.hummingbot/.env"), ".env", ]

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/verify_build.sh (reported line 58)May include surrounding context.
sh
# Load .env file (first match wins) _ENV_PATHS = [ "hummingbot-api/.env", os.path.expanduser("~/.hummingbot/.env"), ".env", ]

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/verify_build.sh (reported line 183)May include surrounding context.
sh
# Load .env file (first match wins) _ENV_PATHS = [ "hummingbot-api/.env", os.path.expanduser("~/.hummingbot/.env"), ".env", ]

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/verify_build.sh (reported line 266)May include surrounding context.
sh
# Load .env file (first match wins) _ENV_PATHS = [ "hummingbot-api/.env", os.path.expanduser("~/.hummingbot/.env"), ".env", ]

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/install_all.sh (reported line 156)May include surrounding context.
sh
API_USER="${API_USER:-admin}" API_PASS="${API_PASS:-admin}" # Load .env for _p in "$API_DIR/.env" "$HOME/.hummingbot/.env" ".env"; do if [ -f "$_p" ]; then while IFS= read -r line; do

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/install_all.sh (reported line 157)May include surrounding context.
sh
API_USER="${API_USER:-admin}" API_PASS="${API_PASS:-admin}" # Load .env for _p in "$API_DIR/.env" "$HOME/.hummingbot/.env" ".env"; do if [ -f "$_p" ]; then while IFS= read -r line; do

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/install_all.sh (reported line 178)May include surrounding context.
sh
API_USER="${API_USER:-admin}" API_PASS="${API_PASS:-admin}" # Load .env for _p in "$API_DIR/.env" "$HOME/.hummingbot/.env" ".env"; do if [ -f "$_p" ]; then while IFS= read -r line; do

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/verify_build.sh (reported line 57)May include surrounding context.
sh
API_USER="${API_USER:-admin}" API_PASS="${API_PASS:-admin}" # Load .env for _p in "$API_DIR/.env" "$HOME/.hummingbot/.env" ".env"; do if [ -f "$_p" ]; then while IFS= read -r line; do

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/verify_build.sh (reported line 179)May include surrounding context.
sh
API_USER="${API_USER:-admin}" API_PASS="${API_PASS:-admin}" # Load .env for _p in "$API_DIR/.env" "$HOME/.hummingbot/.env" ".env"; do if [ -f "$_p" ]; then while IFS= read -r line; do

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/verify_build.sh (reported line 181)May include surrounding context.
sh
API_USER="${API_USER:-admin}" API_PASS="${API_PASS:-admin}" # Load .env for _p in "$API_DIR/.env" "$HOME/.hummingbot/.env" ".env"; do if [ -f "$_p" ]; then while IFS= read -r line; do

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/verify_build.sh (reported line 190)May include surrounding context.
sh
API_USER="${API_USER:-admin}" API_PASS="${API_PASS:-admin}" # Load .env for _p in "$API_DIR/.env" "$HOME/.hummingbot/.env" ".env"; do if [ -f "$_p" ]; then while IFS= read -r line; do

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/verify_build.sh (reported line 194)May include surrounding context.
sh
API_USER="${API_USER:-admin}" API_PASS="${API_PASS:-admin}" # Load .env for _p in "$API_DIR/.env" "$HOME/.hummingbot/.env" ".env"; do if [ -f "$_p" ]; then while IFS= read -r line; do

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/verify_build.sh (reported line 197)May include surrounding context.
sh
API_USER="${API_USER:-admin}" API_PASS="${API_PASS:-admin}" # Load .env for _p in "$API_DIR/.env" "$HOME/.hummingbot/.env" ".env"; do if [ -f "$_p" ]; then while IFS= read -r line; do

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/verify_build.sh (reported line 201)May include surrounding context.
sh
API_USER="${API_USER:-admin}" API_PASS="${API_PASS:-admin}" # Load .env for _p in "$API_DIR/.env" "$HOME/.hummingbot/.env" ".env"; do if [ -f "$_p" ]; then while IFS= read -r line; do

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/verify_build.sh (reported line 203)May include surrounding context.
sh
API_USER="${API_USER:-admin}" API_PASS="${API_PASS:-admin}" # Load .env for _p in "$API_DIR/.env" "$HOME/.hummingbot/.env" ".env"; do if [ -f "$_p" ]; then while IFS= read -r line; do

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

External Script Fetching

Step 3: Confirm local hummingbot is in use

External Script Fetching

Credential Access

Chaining Abuse

Missing User Warnings

Chaining Abuse

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Static analysis