IBKR Trading

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:48 AM UTC
• Version: 1.0.0

Overview

This appears to be a real IBKR trading automation skill, but it gives automation live brokerage authority without enough safety guardrails.

Review carefully before installing. Use an IBKR paper account first, avoid or tightly protect the plaintext .env file, verify the IBKR gateway and Python dependencies, do not enable cron keepalive unless needed, and remove automatic order confirmation or add explicit human approval, maximum order sizes, account limits, symbol allowlists, and a kill switch before connecting this to a live brokerage account.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tainted flow: 'BASE_URL' from os.getenv (line 18, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

def check_auth_status():
    """Check if session is authenticated."""
    try:
        r = requests.get(
            f"{BASE_URL}/v1/api/iserver/auth/status",
            verify=False,
            timeout=10

• Confidence: 96% confidence
• Finding: r = requests.get( f"{BASE_URL}/v1/api/iserver/auth/status", verify=False, timeout=10 )

Tainted flow: 'BASE_URL' from os.getenv (line 18, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

def tickle():
    """Send keepalive ping."""
    try:
        r = requests.post(
            f"{BASE_URL}/v1/api/tickle",
            verify=False,
            timeout=10

• Confidence: 96% confidence
• Finding: r = requests.post( f"{BASE_URL}/v1/api/tickle", verify=False, timeout=10 )

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill clearly instructs use of shell commands, environment variables, and network access, yet it declares no permissions or equivalent safety boundaries. In a trading automation context, undeclared capabilities reduce user visibility into sensitive actions such as credential handling, local process control, and API calls that can affect a brokerage account.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The order placement example provides a ready-to-run live trading request without an explicit warning that it may execute real trades and affect account funds. In this context, omission of that warning is dangerous because users may test commands against a live IBKR account and cause unintended financial loss.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill tells users to store IBKR credentials in a plaintext .env file without warning about the sensitivity of those secrets or the local exposure risk. Brokerage credentials are high-value, and plaintext storage increases the chance of theft through filesystem access, backups, logs, or accidental disclosure.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script globally suppresses insecure TLS warnings and later makes HTTPS requests with verify=False, removing both transport security and visibility into that insecurity. This makes man-in-the-middle attacks and endpoint spoofing much easier, which is dangerous for software maintaining authenticated brokerage sessions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script creates a plaintext .env file intended to hold IBKR credentials and then instructs the user to edit it with live secrets. In a trading automation context, storing broker credentials unencrypted on disk materially increases the risk of account compromise through local disclosure, backups, shell access, or accidental inclusion in version control.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The bot can place orders and then automatically confirm broker warning/reply flows without any explicit human approval, budget guardrail, or policy check. In a trading automation skill, this is especially dangerous because a logic bug, bad signal, compromised strategy input, or unexpected broker prompt could immediately result in real trades and financial loss.

Credential Access

High

• Category: Privilege Escalation

Content

# 3. Run IBeam authentication
cd ~/trading
source venv/bin/activate
source .env
export DISPLAY=:99
Xvfb :99 -screen 0 1024x768x24 &
python -m ibeam --authenticate

• Confidence: 91% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

if [ ! -f ".env" ]; then
    echo ""
    echo "📝 Creating .env template..."
    cat > .env << 'EOF'
# IBKR Credentials - EDIT THESE
IBEAM_ACCOUNT=your_username
IBEAM_PASSWORD='your_password'

• Confidence: 98% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

IBEAM_OAUTH_TIMEOUT=180
IBEAM_PAGE_LOAD_TIMEOUT=60
EOF
    sed -i "s|\${TRADING_DIR}|$TRADING_DIR|g" .env
    echo "✅ Created .env template - EDIT WITH YOUR CREDENTIALS"
else
    echo "✅ .env already exists"

• Confidence: 94% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

IBEAM_PAGE_LOAD_TIMEOUT=60
EOF
    sed -i "s|\${TRADING_DIR}|$TRADING_DIR|g" .env
    echo "✅ Created .env template - EDIT WITH YOUR CREDENTIALS"
else
    echo "✅ .env already exists"
fi

• Confidence: 93% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

#!/bin/bash
cd "$(dirname "$0")"
source venv/bin/activate
source .env

# Start Xvfb if not running
if ! pgrep -x Xvfb > /dev/null; then

• Confidence: 97% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

echo "✅ Setup complete!"
echo ""
echo "Next steps:"
echo "1. Edit .env with your IBKR credentials"
echo "2. Run: ./start-gateway.sh"
echo "3. Wait 20 seconds"
echo "4. Run: ./authenticate.sh"

• Confidence: 92% confidence
• Finding: .env

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

def keepalive():
    try:
        r = requests.post("https://localhost:5000/v1/api/tickle", verify=False, timeout=10)
        status = requests.get("https://localhost:5000/v1/api/iserver/auth/status", verify=False, timeout=10)
        return status.json().get("authenticated", False)
    except:

• Confidence: 98% confidence
• Finding: verify=False

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

def keepalive():
    try:
        r = requests.post("https://localhost:5000/v1/api/tickle", verify=False, timeout=10)
        status = requests.get("https://localhost:5000/v1/api/iserver/auth/status", verify=False, timeout=10)
        return status.json().get("authenticated", False)
    except:
        return False

• Confidence: 98% confidence
• Finding: verify=False

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

Base URL: `https://localhost:5000`

All requests use HTTPS with self-signed certs (use `verify=False` or `-k` with curl).

## Authentication

• Confidence: 96% confidence
• Finding: verify=False

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

try:
        r = requests.get(
            f"{BASE_URL}/v1/api/iserver/auth/status",
            verify=False,
            timeout=10
        )
        data = r.json()

• Confidence: 99% confidence
• Finding: verify=False

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

try:
        r = requests.post(
            f"{BASE_URL}/v1/api/tickle",
            verify=False,
            timeout=10
        )
        return r.status_code == 200

• Confidence: 99% confidence
• Finding: verify=False

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

self.base_url = base_url
        self.account_id = account_id
        self.session = requests.Session()
        self.session.verify = False
    
    def _get(self, endpoint: str, params: dict = None) -> dict:
        r = self.session.get(f"{self.base_url}{endpoint}", params=params, timeout=15)

• Confidence: 99% confidence
• Finding: verify = False

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.