Helix Trader

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:37 AM UTC
• Version: 1.0.0

Overview

This skill is purpose-aligned for a local crypto trading bot, but its install and startup guidance creates Review-level risk around mutable remote code, exposed admin access, and exchange credentials.

Review carefully before installing. Prefer a pinned Helix Trader release or audited commit, inspect setup_backend.sh before running it, bind the backend to 127.0.0.1 instead of 0.0.0.0, remove --reload for normal use, change default admin credentials and JWT_SECRET before startup, and use testnet keys with minimum permissions and no withdrawal access.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: INSTALL.md:18

Finding

Execution of Mutable Code Retrieved from an Unpinned Remote Repository

Content

View full analysis

Vulnerability Details

File Location: INSTALL.md, lines 18-30; also referenced by PLAYBOOK.md, line 66
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Medium

Vulnerable commands:

bash

git clone https://github.com/trade-upnow/helix-trader.git
cd helix-trader

bash

bash scripts/setup_backend.sh

Technical Analysis

The installation workflow clones the current default branch of an external GitHub repository and subsequently executes scripts/setup_backend.sh. It does not pin the download to a reviewed commit hash or signed release, nor does it require checksum or signature verification before execution.

Consequently, the effective script payload can change after this Skill has been reviewed. The external repository and setup script were not included in the audited artifact, so their implementation could not be verified. Although the source and execution are disclosed and there is no direct evidence of malicious intent, this creates a mutable remote-code trust boundary.

This issue is classified as T03: Remote Payload Retrieval and Execution because executable code is retrieved from an external location and run locally without immutable version or integrity controls.

Attack Path

1. An attacker compromises the referenced GitHub account or obtains permission to modify the repository.
2. Alternatively, a malicious or vulnerable change is introduced into the repository's default branch.
3. A user follows the documented installation procedure and clones the current default branch.
4. The user executes bash scripts/setup_backend.sh without validating its revision, signature, checksum, or contents.
5. The altered script executes with the user's local privileges.
6. The payload could access files available to that user, modify the installed runtime, or implant code that later observes exchange credentials.

Impact Assessment

Successful exploitat ...[truncated 625 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installation to a specific, reviewed commit hash or immutable release tag.
2. Prefer a signed release artifact rather than cloning a mutable default branch.
3. Publish an expected SHA-256 checksum and require users to verify it before execution.
4. Verify Git commit or release signatures against a documented maintainer key.
5. Display and validate the resolved commit hash before running any setup script.
6. Recommend reviewing the setup script before execution.
7. Avoid piping or automatically passing remotely retrieved content directly to a shell.
8. Record the tested runtime revision in the Skill so future upstream changes require a new security review.

T09 · Insecure Skill Coding Practices

Error

• Location: INSTALL.md:51

Finding

Backend Exposed on All Network Interfaces with Predictable Administrator Defaults

Content

View full analysis

Vulnerability Details

File Location: INSTALL.md, lines 51-62; related default credentials are repeated in PLAYBOOK.md, line 15
Vulnerability Type: Unsafe network exposure and predictable default credentials
Risk Level: High

Vulnerable server command:

bash

cd backend
source .venv/bin/activate
uvicorn app.main:app --reload --host 0.0.0.0 --port 8000

The same installation section documents commonly used administrator defaults as admin and ChangeMe123!.

Technical Analysis

The documented command binds the backend to 0.0.0.0, causing it to listen on every available network interface rather than only the local loopback interface. Other systems may therefore reach the service when permitted by host firewall, container, virtual-machine, or network configuration.

The workflow also documents predictable administrator credentials but does not make replacing them a mandatory prerequisite before starting the externally reachable service. If the external runtime accepts these defaults, an attacker can attempt authentication using publicly documented values.

The command additionally enables Uvicorn's --reload development mode. Reload mode is unnecessary for routine bot operation and increases the exposed development surface.

This conflicts with the Skill's stated local-only operating model and violates secure-default and least-exposure principles. Actual authentication behavior could not be confirmed because the external runtime implementation was not included in the audited artifact.

Attack Path

1. A user configures or retains the documented administrator defaults.
2. The user starts the backend with --host 0.0.0.0.
3. The host firewall or local network allows another system to connect to TCP port 8000.
4. An attacker discovers the exposed service through local network scanning or known host access.
5. The attacker attempts authentication using admin and ChangeMe123!.

...[truncated 1052 chars]

Remediation

View remediation

Remediation Suggestions

1. Change the default startup command to bind only to loopback:

   bash

   uvicorn app.main:app --host 127.0.0.1 --port 8000
   

2. Remove --reload from normal operational instructions and reserve it for explicit development workflows.
3. Require a unique, strong administrator password before the backend can start.
4. Make the runtime reject known defaults such as admin and ChangeMe123!.
5. Generate initial credentials randomly or require interactive creation during setup.
6. Add a startup check that refuses non-loopback binding when default or weak credentials are configured.
7. If remote access is required, mandate TLS, firewall allowlisting, strong authentication, rate limiting, and account lockout controls.
8. Document that port 8000 must not be exposed through router forwarding, public cloud security groups, or container port publishing without additional protection.
9. Add automated tests verifying that production startup defaults to loopback and that predictable credentials are rejected.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (14)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The skill explicitly guides the user to place exchange API credentials into backend/.env as an input source before saving them into the backend. Even though it says not to read or display keys, instructing users to store secrets in plaintext local configuration increases the risk of accidental disclosure through shell history, editor backup files, misconfigured permissions, screenshots, or later debugging steps.

Content

Scanner excerpt · INSTALL.md (reported line 109)May include surrounding context.

先问用户用 OKX 还是 Binance，再保存。凭证以后端数据库为准；填进 .env ≠ 已保存。

bash

# 路径 A（长期复用）：.env 作输入源，再写入后端
# 编辑 backend/.env：HELIX_EXCHANGE_API_KEY / SECRET（OKX 还需 PASSPHRASE）
python -m app.agent save-credentials --exchange okx --testnet --confirm-save-credentials

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · INSTALL.md (reported line 113)May include surrounding context.

编辑 backend/.env：HELIX_EXCHANGE_API_KEY / SECRET（OKX 还需 PASSPHRASE）

python -m app.agent save-credentials --exchange okx --testnet --confirm-save-credentials

路径 B（首次推荐）：交互输入，可不写 .env 交易所密钥

python -m app.agent save-credentials --exchange okx --testnet --prompt --confirm-save-credentials

text

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest description explicitly says to 'skip configuration preview,' but this playbook states '必须保留策略预览' and later requires preview_bot_config before startup. This is an active contradiction between documented intent and the skill guidance that governs behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The playbook marks preview_bot_config as mandatory and explicitly says '不能做什么 - 跳过 preview,' which directly opposes the manifest's 'skip configuration preview' instruction. This is not just an omission; it is an explicit behavioral contradiction in the skill's own documentation.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PLAYBOOK.md (reported line 94)May include surrounding context.

md

| 现象 | 优先工具 | 恢复方向 |
|------|----------|----------|
| 首次还不能跑 | `doctor` | setup + 起后端 |
| Missing access token | `login` | 重新登录 |
| mode=`not_configured` | `get_runtime_mode` | 保存凭证到后端（`--prompt` 或 `.env`+save；勿看 `.env` 空值误判） |
| 访问不了交易所网络 | `doctor.network` | 直连→7890→问代理 |
| 交易对不可用 | `list_markets` | 换符号后再 preview |

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

All headings, examples, and agent prompts in the file are written exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only region or audience. This can violate language/locale policy when a skill imposes a language without user opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The example trigger '帮我启动这个机器人' is broad enough that normal conversational requests could invoke a high-risk trading workflow without strong scoping. In a crypto-bot skill, accidental activation is more dangerous than in low-risk domains because it can lead the agent into setup, credential guidance, and eventually live-trading actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The stop example uses the generic command '停止机器人', which lacks application and asset-management scope and could be matched from ordinary language. In this context, a mistaken stop flow can alter an active trading system and, depending on follow-up choices, contribute to unintended position handling or trading interruption.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation examples use a very generic phrase like '帮我启动机器人', which can overlap with ordinary conversation and cause the skill to activate unintentionally. In a crypto-trading context, accidental invocation is more dangerous because it can steer users into operational workflows that may lead to credential entry, configuration changes, or trading actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill file is written in Chinese and provides no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-language audience. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file explicitly prioritizes use of preview_bot_config, which conflicts with the stated skill policy to skip configuration preview. In a crypto-bot context, inconsistent operator guidance can cause the agent to perform disallowed preview actions, potentially exposing sensitive configuration details or undermining higher-level safety constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The title and core instructions are written as a Chinese-only playbook for agent-user interaction, and no alternative language or opt-in mechanism is provided. This is a natural-language policy concern because it effectively forces a specific language/locale without documenting user choice or a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest description says to 'skip configuration preview,' while the body of the skill requires running preview_bot_config and obtaining explicit confirmation before start. In a crypto-trading context, that contradiction can cause an agent or user to bypass the final safety check and launch with unintended exchange, strategy, testnet/live, or position-handling settings.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The phrase "对用户用人话推进" appears in a Chinese-language instruction set that implicitly fixes the interaction language and style, but the document does not state that the user may choose another language. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.