Ask a Legend

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:54 AM UTC
• Version: 0.1.0

Overview

The skill appears intended for market analysis, but it asks the agent to fetch and run unpinned external code and handle an API key in ways users should review carefully.

Install only if you are comfortable with this skill downloading and running external trading-analysis code, creating persistent files under ~/.tlc, and storing provider configuration locally. Do not send API keys through chat; use an out-of-band local secret setup and rotate any key previously shared through Telegram or another messaging channel.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:21

Finding

Mutable Remote Repositories and Dependencies Are Retrieved and Executed

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:83

Finding

TradingView API Key May Be Transmitted Through Telegram and Stored in a Shared Plaintext File

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill instructs the agent to read and write its own operational files, including temp artifacts, spec files, and configuration. Self-modification and local state mutation increase the risk of persistence, tampering, and hard-to-audit behavior, especially when combined with remote code bootstrap and secret handling.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

into this call. Re-assert `cd "$TLC_HOME"` + the PATH export in `terminal` and
  retry there. **Never** let such an error override data you already fetched
  successfully earlier in the same conversation — reuse that data, don't discard it.
- **Read and write this skill's files in `terminal` too** — temp `frames.json`/
  `packet.json`/`ballot.json`, spec files, `config.yaml`/`.env`. Every path here
  is relative to `$TLC_HOME`; if you use any other tool for a file, give it the
  **absolute** path under `$TLC_HOME`, or the next terminal command won't find it.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The skill explicitly checks for and uses .env and other local secret/config files as part of its runtime flow. In the context of an agent skill, direct secret-file handling is dangerous because it normalizes credential collection and persistence inside an untrusted automation path that also executes external code.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

subtler form of fabricating data.

## 0b. First-run setup (auto-configure — runs ONLY when config is missing)
Still inside `$TLC_HOME`, check for config: `ls .env config.yaml 2>/dev/null`.
- **Both present → already configured. Continue to §1, and do NOT re-prompt for
  anything** (including a TV key): if TradingView is enabled but `.env` has no
  `TVR_API_KEY`, say so **once**, only the first time a TV symbol is actually

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to solicit, receive over chat, and persist a TradingView API key to disk. Collecting and handling user secrets exceeds the analysis-only purpose and creates clear secret-exposure risk through chat logs, terminal history, local file compromise, or downstream tool leakage.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill’s stated purpose is simple market analysis, but it performs network bootstrap actions on every run by cloning/updating code and installing dependencies. That creates a substantial supply-chain and arbitrary code execution risk because unpinned remote content is executed in the user environment without being essential to the advertised function.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Repository management and environment provisioning are powerful capabilities unrelated to a simple trader-style read, and they materially increase the attack surface. Because these steps fetch and execute external code, compromise of an upstream repo, dependency, or install script could lead to host-level code execution or persistence.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is presented as analysis-only, yet it also creates and modifies local configuration and secret-bearing files during first run. This expands its privilege and persistence footprint beyond user expectations, increasing the chance of unsafe secret storage, configuration tampering, and unintended state changes on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The instructions encourage storing a user-supplied API key but do not give a strong warning about the risks of transmitting and persisting secrets. Users may reasonably assume chat is safe for secrets, causing accidental disclosure into logs, transcripts, backups, or other retention systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

Instructing the agent to delete messages containing API keys may conflict with platform retention guarantees, compliance controls, or audit requirements, and it may create a false sense that the secret is no longer recoverable. While intended as damage reduction, it can undermine governance and mislead users about actual deletion capabilities.

Content

No source excerpt is available for this finding.