Security audit

Helix Trader

Security checks across malware telemetry and agentic risk

Overview

The skill is coherent for a local crypto trading bot, but it needs Review because it handles exchange credentials and trading actions while setup guidance may expose a local service using common default admin credentials.

Review this skill before installing. Use it only if you intend to run Helix Trader locally, change any default admin password, bind the web UI/backend to localhost unless you deliberately need network access, keep exchange API keys out of chat, use testnet first, and require an explicit confirmation before any live trading or position-closing action.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The playbook instructs the agent to suggest common default admin credentials for a local web interface (`admin` / `ChangeMe123!`). Even if framed as 'common defaults,' publishing or encouraging predictable credentials materially weakens access control and can lead users to keep insecure defaults, especially on self-hosted services that may later become network-exposed.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The startup flow includes doctor with network checks, setup, backend start, and login, but does not tell the agent to warn the user before network-affecting operations or before handling exchange credential setup. In a crypto-trading context, unclear consent and missing warnings can lead users to authorize sensitive actions without understanding that external connections, account linking, or credential storage are involved.

Missing User Warnings

High

Confidence: 93% confidence
Finding: The example for moving from testnet to live trading lacks an explicit risk warning about real-money trading, possible immediate order placement, financial loss, and the need to verify exchange credentials and runtime mode. In this skill's context, switching to live mode is materially dangerous because the next start action may trigger real trades with direct financial consequences.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The example trigger phrases are broad, natural-language requests such as “帮我启动这个机器人”, which overlap with ordinary user speech and can cause the skill to activate in situations where the user did not clearly intend to invoke this specific crypto-trading workflow. In a trading context, accidental activation is more dangerous because the skill guides users toward credential setup, exchange selection, previews, and potentially bot startup, increasing the chance of unintended sensitive or high-risk actions.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The instruction to use Chinese-language phrasing by default can override the user's language preference and reduce clarity if the user is operating in another language. In a security- and finance-adjacent setup flow, language mismatch can cause misunderstanding of important warnings, mode distinctions such as testnet versus live trading, or credential-handling instructions.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.