Forge a Trading Legend

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:58 AM UTC
• Version: 0.1.0

Overview

The skill mostly matches its trading-strategy purpose, but it asks the agent to install mutable remote code and handle an optional API key in ways users should review carefully.

Install only if you trust the publisher and are comfortable with the skill downloading and running code from GitHub under your user account. Do not send API keys through chat; configure secrets locally or skip TradingView. Review the generated config and roster changes before relying on any live trading output.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:21

Finding

Mutable Remote Code and Dependencies Are Retrieved and Executed Without Integrity Pinning

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:82

Finding

Optional API Credential May Be Transmitted Through and Retained by a Chat Service

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (6)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill instructs the agent to read and write project files including my_legends/<id>.md, ballot.json, config.yaml, and .env. Self-modifying or environment-modifying behavior increases risk because broad invocation or prompt injection could cause unintended persistence, configuration drift, or tampering with files that affect future runs, especially when secrets and runtime config are in scope.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

into this call. Re-assert `cd "$TLC_HOME"` + the PATH export in `terminal` and
  retry there. **Never** let such an error override data you already fetched
  successfully earlier in the same conversation — reuse that data, don't discard it.
- **Read and write this skill's files in `terminal` too** — the draft spec at
  `my_legends/<id>.md`, temp `ballot.json`, `config.yaml`/`.env`. Every path here
  is relative to `$TLC_HOME`; if you use any other tool for a file, give it the
  **absolute** path under `$TLC_HOME`, or the next terminal command won't find it.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The skill directly references .env handling as part of its workflow and later instructs storing API credentials there. In a skill context, credential discovery and manipulation of .env files can expose secrets to the agent runtime, logs, or unintended tooling, especially when combined with instructions to read and write files from the terminal.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

subtler form of fabricating data.

## 0b. First-run setup (auto-configure — runs ONLY when config is missing)
Still inside `$TLC_HOME`, check for config: `ls .env config.yaml 2>/dev/null`.
- **Both present → already configured. Continue, and do NOT re-prompt for
  anything** (including a TV key): if TradingView is enabled but `.env` has no
  `TVR_API_KEY`, say so **once**, only the first time you audition on a TV symbol

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description says the skill authors a legend from a famous trader's name or a plain-English strategy description, with examples like "make a trader who buys liquidity sweeps" and "add an ICT legend." These are natural everyday phrasings and the file does not provide explicit constraints, negative examples, or a narrow invocation context, which could cause unintended activation overlap.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The instruction "Forge a new legend from $ARGUMENTS" combined with infer-first behavior indicates very flexible natural-language input, but it does not clearly define what requests are in-scope versus out-of-scope. Without explicit boundaries or negative examples, common strategy-discussion requests could ambiguously match this skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs first-run handling of a TradingView API key, including prompting for it, storing it in .env, and in remote contexts accepting it via chat. That exceeds the narrow purpose of authoring a trading legend and creates an unnecessary credential-handling path inside a skill that may run in conversational environments where secrets can be logged, retained, or exposed.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill tells users in Telegram/remote contexts to send a TradingView API key through chat, then save it to .env and optionally delete the message. This creates a natural-language secret exfiltration path because chat systems, logs, integrations, moderators, or other participants may retain or access the secret even if the visible message is later deleted.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.