Security audit

longbridge

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real LongPort brokerage CLI, but it tells AI agents to bypass trade confirmations while using stored brokerage credentials.

Install only if you intend to let an AI-accessible CLI read your Longbridge account data. Keep the default read-only mode unless you are deliberately trading, avoid using --yes/-y for live orders, prefer a paper or read-only profile for agent workflows, and review the profile/env-file handling and dependency pinning before using it with a real brokerage account.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:121
Finding: AI Agent Instructions Recommend Bypassing Live-Trade Confirmation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: longbridge_cli/config.py:21
Finding: Unvalidated Profile Name Allows Environment-File Path Traversal
Content: View full analysis
/../target.env ``` If the resulting file exists, the loader reads it and imports every parsed key into the current process environment. The code does not restrict profile names to identifiers, resolve and validate the final path against an approved direct ...[truncated 1581 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: pyproject.toml:1
Finding: Security-Critical Brokerage Dependencies Are Not Reproducibly Pinned
Content: View full analysis
=42", "wheel"] build-backend = "setuptools.build_meta" [project] name = "longbridge-cli" version = "1.0.0" description = "LongPort OpenAPI CLI" requires-python = ">=3.9" dependencies = [ "longbridge", "click>=8.0", "rich>=13.0", ] ``` ```text longbridge click>=8.0 rich>=13.0 ``` ### Technical Analysis The project does not pin the `longbridge` SDK to a reviewed version and supplies no lockfile or package hashes. The lower-bound-only constraints on `click` and `rich` likewise allow future versions to be selected automatically. Build dependencies are also mutable. This is especially sensitive because the Longbridge SDK receives the application key, application secret, and access token and provides the methods used to read account data and submit brokerage orders. A compromised, malicious, or unexpectedly incompatible future release would be installed without a source change in this project. The audit did not establish that any currently referenced package is malicious. The confirmed issue is the absence of reproducible dependency controls around a credential-bearing, trade-capable application. ### Attack Path 1. A dependency publisher account or upstream distribution channel is compromised, or an incompatible future version is released. 2. A user follows the Skill installation instruction and runs `uv tool install` for the project. 3. The resolver selects the newly available dependency because no exact reviewed version or hash is required. 4. The package executes during installation, import, or runtime. 5. Malicious dependency code can access the CLI process, environment credentials, account-query results, and SDK call flow. 6. Depending on the credentials and configuration, it could disclose secret ...[truncated 555 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: longbridge_cli/commands/order.py:59
Finding: Live Order Parameters Lack Local Range and Finiteness Validation
Content: View full analysis
Remediation: View remediation
)` for quantity. 2. Parse prices directly as `Decimal` rather than binary `float`. 3. Reject non-finite, zero, and negative prices. 4. Enforce instrument-specific price precision, tick size, and lot size. 5. Validate symbol syntax and normalize market suffixes before submission. 6. Calculate estimated notional value and enforce configurable per-order and daily limits. 7. Perform validation before presenting the confirmation prompt so the user approves canonical values. 8. Retain server-side validation as defense in depth, but do not treat it as a substitute for local checks. 9. Add tests for zero, negative, excessive, non-finite, malformed, and precision-invalid inputs. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (41)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 69)May include surrounding context.
md
|----------|----------|-------------| | `LONGBRIDGE_APP_KEY` | ✅ | App Key | | `LONGBRIDGE_APP_SECRET` | ✅ | App Secret | | `LONGBRIDGE_ACCESS_TOKEN` | ✅ | Access Token | | `LONGBRIDGE_TRADE_ENABLED` | Optional | Set to `true` to enable trading (default: read-only) | ---

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear mismatch between the description and the supplied code chunk. The description claims a full-featured LongPort CLI covering quotes, holdings, orders, and market analytics. However, the actual code is only an __init__.py file with a package docstring and no executable logic or exposed functionality. Based on the provided code alone, none of the declared capabilities are present.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 代码文件是 commands/quote.py，从实现上看只注册了 quote、depth、trades、candlesticks、info 五个命令，全部依赖 QuoteContext 获取行情或标的静态信息。没有看到账户上下文、订单上下文、交易接口、持仓查询或任何资金/期权相关调用。因此，若将“该 skill”的声明理解为这段代码所代表的能力，则声明明显比实际代码宽得多，尤其把账户和订单管理说成已提供，构成描述与行为不一致。虽然声明中的行情查询部分与代码一致，但整体用途被显著夸大，因此应判定为 mismatch。
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger language is extremely broad and includes ordinary requests like checking a stock price or 'help me place an order,' causing the skill to auto-activate in many ambiguous situations. In this context the skill has access to brokerage credentials and trading commands, so overbroad invocation materially raises the risk of unintended access to account data or accidental execution of sensitive financial actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation explicitly recommends using --yes/-y to bypass trade confirmations for AI agent automation, without strong safeguards or warnings. In a brokerage skill, this removes a key human-in-the-loop control and can enable erroneous or unauthorized buy, sell, or cancel actions with immediate financial consequences.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 26)May include surrounding context.
md
# --------------------------------------------------------------------------- # .env 加载（CLI 包自包含，不依赖 trader 包） # --------------------------------------------------------------------------- def _load_dotenv_for_profile(profile: str | None = None) -> None:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 261)May include surrounding context.
md
# --------------------------------------------------------------------------- # .env 加载（CLI 包自包含，不依赖 trader 包） # --------------------------------------------------------------------------- def _load_dotenv_for_profile(profile: str | None = None) -> None:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 290)May include surrounding context.
md
# --------------------------------------------------------------------------- # .env 加载（CLI 包自包含，不依赖 trader 包） # --------------------------------------------------------------------------- def _load_dotenv_for_profile(profile: str | None = None) -> None:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 524)May include surrounding context.
md
# --------------------------------------------------------------------------- # .env 加载（CLI 包自包含，不依赖 trader 包） # --------------------------------------------------------------------------- def _load_dotenv_for_profile(profile: str | None = None) -> None:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · longbridge_cli/cli.py (reported line 29)May include surrounding context.
python
# --------------------------------------------------------------------------- # .env 加载（CLI 包自包含，不依赖 trader 包） # --------------------------------------------------------------------------- def _load_dotenv_for_profile(profile: str | None = None) -> None:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · longbridge_cli/config.py (reported line 10)May include surrounding context.
python
# --------------------------------------------------------------------------- # .env 加载（CLI 包自包含，不依赖 trader 包） # --------------------------------------------------------------------------- def _load_dotenv_for_profile(profile: str | None = None) -> None:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · longbridge_cli/config.py (reported line 14)May include surrounding context.
python
# --------------------------------------------------------------------------- # .env 加载（CLI 包自包含，不依赖 trader 包） # --------------------------------------------------------------------------- def _load_dotenv_for_profile(profile: str | None = None) -> None:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · longbridge_cli/config.py (reported line 21)May include surrounding context.
python
profile 非空 + 文件不存在 → 抛 FileNotFoundError。已存在的环境变量不会被覆盖。 """ filename = f".{profile}.env" if profile else ".env" env_path: Path | None = None for base in [Path.cwd(), Path.home()]: candidate = base / filename

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 28)May include surrounding context.
Method 1: .env file (recommended)

Create a .env file in the current directory or home directory (~/.env):

bash
LONGBRIDGE_APP_KEY=your_app_key

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The README explicitly documents --yes/-y to bypass confirmation for buy/sell operations, enabling non-interactive trade execution. In an AI-agent context, this materially increases the chance of autonomous or accidental order placement if the agent is permitted to invoke the CLI with trading enabled.
Content: Scanner excerpt · README.md (reported line 144)May include surrounding context.
Cancel order (confirmation prompt)

longbridge cancel 701234567890

Skip confirmation for programmatic / scripted use

longbridge buy AAPL.US --qty 100 --price 180.0 --yes longbridge sell 700.HK --qty 500 --price 320.0 -y

text

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 174)May include surrounding context.
Copy SKILL.md to your OpenClaw skills directory to register it as a Clawdbot Skill:

bash
mkdir -p ~/.openclaw/skills/longbridge-cli cp SKILL.md ~/.openclaw/skills/longbridge-cli/SKILL.md

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 437)May include surrounding context.
Copy SKILL.md to your OpenClaw skills directory to register it as a Clawdbot Skill:

bash
mkdir -p ~/.openclaw/skills/longbridge-cli cp SKILL.md ~/.openclaw/skills/longbridge-cli/SKILL.md

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 175)May include surrounding context.
bash
mkdir -p ~/.openclaw/skills/longbridge-cli cp SKILL.md ~/.openclaw/skills/longbridge-cli/SKILL.md

Once installed, Claude can invoke longbridge-cli commands automatically when you ask about account balances, positions, quotes, or orders.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 438)May include surrounding context.
bash
mkdir -p ~/.openclaw/skills/longbridge-cli cp SKILL.md ~/.openclaw/skills/longbridge-cli/SKILL.md

Once installed, Claude can invoke longbridge-cli commands automatically when you ask about account balances, positions, quotes, or orders.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: The combination of persistent multi-account profile files (.<name>.env) and documented non-interactive trade execution increases the blast radius of mistakes: an agent or script can repeatedly access stored live credentials and place trades without human confirmation. In a trading skill, this persistence is more dangerous than in a read-only data tool because it supports durable access to high-impact actions.
Content: Scanner excerpt · README.md (reported line 256)May include surrounding context.
md
### Notes - **Read-only mode**: `buy`/`sell`/`cancel` require `LONGBRIDGE_TRADE_ENABLED=true` - **Trade confirmation**: Even with trade permission enabled, all write commands prompt for confirmation before executing. Use `--yes` / `-y` to skip the prompt for scripted or programmatic use - **Multi-account profiles**: Use `longbridge --profile <name>` to load `.<name>.env` credentials (e.g., `--profile paper` loads `.paper.env`). Useful for switching between paper trading and live accounts - **HK symbol format**: Must use 4-digit format, e.g. `0700.HK` (leading zero required) - **Error handling**: SDK exceptions are caught and displayed as friendly messages

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares access to sensitive environment variables containing API credentials but does not define any explicit tool scope or permission boundary. In an agent setting, this increases the chance that secrets are exposed to components or workflows beyond what is necessary, especially since the skill also supports account and trading operations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module's docstrings, help text, table headers, and titles are all presented in Chinese, with no indication that users can select another language or that the tool is intentionally limited to a Chinese-speaking locale. This can violate language/locale policy when a skill forces a specific language without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The command retrieves account balance and net asset information via TradeContext(...).account_balance() and then prints it, but the code provides no explicit warning, confirmation, or disclosure that sensitive financial account data will be accessed and displayed. For code files, safety-relevant access to sensitive data should have some visible disclosure unless clearly covered elsewhere.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The positions command fetches portfolio holdings using stock_positions() and outputs symbols, quantities, and cost basis data, which are sensitive financial details. There is no confirmation prompt, disclosure message, or warning in the command text indicating that personal portfolio data will be retrieved and shown.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The funds command retrieves fund holding details, including holdings, valuation, and cost data, then prints them without any explicit disclosure to the user. This is sensitive account information, and the code does not include a warning, confirmation, or explanatory notice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

Credential Access

Tp4

Tp4

Vague Triggers

Missing User Warnings

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Session Persistence

Method 1: .env file (recommended)

Autonomous Decision Making

Cancel order (confirmation prompt)

Skip confirmation for programmatic / scripted use

Session Persistence

Session Persistence

Skill Enumeration

Skill Enumeration

Session Persistence

Undeclared Tool Scope

Natural-Language Policy Violations

Missing User Warnings

Missing User Warnings

Missing User Warnings

Static analysis