Convene

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:54 AM UTC
• Version: 0.1.0

Overview

This finance-analysis skill is not clearly malicious, but it automatically fetches and runs mutable external code and handles API keys in ways users should review carefully.

Review this skill before installing. It is a market-analysis tool, but first use or normal use may download and run code from GitHub, install Python dependencies, inspect local MT5 terminals, and store an optional TradingView API key in a plaintext .env file. Prefer only installing it in a contained environment, pinning reviewed code versions, and entering any API key through a secure local secret mechanism rather than chat.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:18

Finding

Automatic Retrieval and Execution of Mutable Remote Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–21 and 67–69
Vulnerability Type: Mutable remote code and unpinned third-party dependencies
Risk Level: High

Vulnerable Code

markdown

## 0. Bootstrap (every run — cheap and idempotent)
Run `scripts/setup.sh` (in this skill's own directory) and capture its stdout as `TLC_HOME`
(it clones/updates `github.com/FXDavid-OffbeatForex/TLC` under `~/.tlc/` and
installs `requirements.txt` into an isolated venv at `$TLC_HOME/.venv`).

markdown

2. **MT5 — the zero-config, no-key default.** MBT lives at `$TLC_HOME/MBT`
   (clone `github.com/FXDavid-OffbeatForex/MBT` there + `pip install -r
   MBT/requirements.txt` if absent); `tlc.providers.mt5` puts it on `sys.path`,

Technical Analysis

The Skill instructs the Agent to clone or update two external GitHub repositories, install their Python dependencies, add the resulting virtual environment to PATH, and execute modules obtained from those repositories. No immutable commit hash, signed release, package hash, or dependency lock with integrity verification is specified.

Updating TLC on every run allows the effective implementation to change after this Skill has been reviewed. The MBT repository and transitive packages installed from its requirements.txt are similarly outside the audited artifact. The referenced scripts/setup.sh, remote source trees, and dependency manifests were not included in the project, so their behavior could not be independently verified during this audit.

Isolation in a virtual environment protects the system Python package set, but it does not sandbox installed code. Python installation hooks and subsequently executed modules retain the operating-system privileges of the Agent process. Prepending the remote environment to PATH also causes subsequent commands to resolve executables from that environment.

Attack Path

1. An attacker compromises the TLC r ...[truncated 1229 chars]

Remediation

View remediation

Remediation Suggestions

1. Package all required reviewed source code with the Skill instead of updating executable code during each invocation.
2. Pin TLC and MBT to immutable commit hashes or signed, versioned releases.
3. Verify repository signatures or expected archive checksums before installation or execution.
4. Replace unconstrained dependency installation with a lock file containing exact versions and cryptographic hashes, such as a hash-locked requirements.txt.
5. Disable automatic updates. Require an explicit, separately reviewed upgrade action when versions change.
6. Run installation and market-analysis components in a restricted sandbox with narrowly scoped filesystem and network access.
7. Avoid globally trusting the downloaded virtual environment through broad PATH modification; invoke the pinned interpreter by absolute path.
8. Audit and include scripts/setup.sh, the relevant TLC and MBT source, and all dependency manifests in the review boundary.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:83

Finding

TradingView API Key Collection Through a Messaging Channel

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 83–90
Vulnerability Type: Sensitive credential transmission and plaintext storage
Risk Level: Medium

Vulnerable Code

markdown

3. **TradingView key — ask once here (first-run only, never again).** Tell the
   user TV is optional and needs a free key from tvremix.xyz (account → API
   keys), then let them add it now or skip:
   - **Desktop/local:** open `$TLC_HOME/.env` (`code .env` / reveal it) and have
     them paste it in a real editor and save — **key stays in the file, not chat.**
   - **Telegram/remote:** they send it; **save to `$TLC_HOME/.env` immediately
     (and delete their message if the channel supports it)**. Or **"skip"** —
     MT5 works with no key.
   If skipped, leave `TVR_API_KEY` blank; TradingView stays unavailable until
   someone adds it to `$TLC_HOME/.env` (it's one shared file — set once, works

Technical Analysis

The remote setup path explicitly asks the user to send an API key through Telegram. Although the instruction recommends saving the key immediately and deleting the message where supported, deletion is not a reliable confidentiality control. The credential may already have passed through messaging infrastructure, bot integrations, notifications, synchronized clients, backups, moderation systems, or channel logs.

The key is then stored in a shared plaintext .env file. The instructions do not specify restrictive filesystem permissions, ownership validation, encryption at rest, or use of an operating-system credential store. The statement that one shared file works from every interface implies that multiple interfaces or processes may be able to access the same credential.

Local entry through a real editor is comparatively safer and is functionally related to TradingView authentication. The confirmed issue is the explicit chat-based collection path and the absence of defined access controls for subseq ...[truncated 1276 chars]

Remediation

View remediation

Remediation Suggestions

1. Never request or accept API keys in chat messages, including Telegram direct messages.
2. For remote operation, provide an authenticated local secret-entry command, protected setup page, operating-system keychain integration, or dedicated secret manager.
3. Ensure secret values are entered directly into the credential store without being echoed into chat, terminal history, application logs, or Agent transcripts.
4. Prefer an OS credential store over .env. If .env remains necessary, create it with owner-only permissions, such as mode 0600 on POSIX systems, and validate ownership before reading it.
5. Do not share one credential file indiscriminately across interfaces. Give each component access only to the specific secret it requires.
6. Add secret redaction to logs and error reporting, and prevent the Agent from displaying .env contents.
7. Document credential revocation and rotation procedures for users who previously submitted a key through chat.
8. Continue allowing users to skip TradingView setup so no credential is collected when MT5 alone satisfies the requested functionality.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (7)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill tells the agent to read and write files within its working tree, including temp JSON, spec files, config.yaml, and .env. While some temporary output is normal, permitting writes to spec and configuration files gives the skill self-modifying behavior and persistent state changes that can alter future executions or tamper with local configuration beyond the immediate request.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

into this call. Re-assert `cd "$TLC_HOME"` + the PATH export in `terminal` and
  retry there. **Never** let such an error override data you already fetched
  successfully earlier in the same conversation — reuse that data, don't discard it.
- **Read and write this skill's files in `terminal` too** — temp `frames.json`/
  `packet.json`/`ballot.json`, spec files, `config.yaml`/`.env`. Every path here
  is relative to `$TLC_HOME`; if you use any other tool for a file, give it the
  **absolute** path under `$TLC_HOME`, or the next terminal command won't find it.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill references .env handling in a way that leads directly into checking for, populating, and later storing TVR_API_KEY. This is a credential-handling pattern: the agent is instructed to manage secrets in local files and, in some cases, accept them over chat, which risks credential disclosure through logs, transcripts, backups, or accidental file exposure.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

subtler form of fabricating data.

## 0b. First-run setup (auto-configure — runs ONLY when config is missing)
Still inside `$TLC_HOME`, check for config: `ls .env config.yaml 2>/dev/null`.
- **Both present → already configured. Continue, and do NOT re-prompt for
  anything** (including a TV key): if TradingView is enabled but `.env` has no
  `TVR_API_KEY`, say so **once**, only the first time a TV symbol is actually

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill says to convene on the symbol/timeframe/platform found in $ARGUMENTS and gives examples like "what does the council think of AAPL?" and "convene the orderflow council on EURUSD," which overlap with natural conversational phrasing and do not clearly bound when this skill should activate versus general market-analysis requests. The file does not provide explicit trigger constraints or negative examples to prevent unintended invocation collisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill bootstraps by running a setup script that clones or updates a remote GitHub repository, installs Python dependencies, and writes local files, but the description does not prominently warn users that code will be fetched and executed on first run. This creates a software supply-chain and local system modification risk that is materially more dangerous than the advertised 'analysis' purpose suggests.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs the agent to inspect running MT5 processes, search local install paths, open local editors, and reveal files. These actions go beyond ordinary market-analysis behavior and expand access into host reconnaissance and local environment manipulation, increasing privacy and safety risk if performed automatically or without explicit consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to collect, store, and potentially receive a TradingView API key via chat, then persist it in a local .env file. Secret collection and persistence are sensitive operations that exceed what users would reasonably expect from a simple analysis skill, and storing secrets through the skill creates unnecessary exposure if logs, transcripts, or local files are accessed later.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill's manifest/description does not clearly disclose that users may be asked to provide and store a TradingView API key. Handling credentials without an upfront privacy/security notice can mislead users about data sensitivity and increases the chance they share secrets in unsafe channels such as chat history.

Content

No source excerpt is available for this finding.