Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed remote DeFi strategy assistant; it sends strategy inputs to Gekko's API but does not execute trades, use wallets, persist locally, or hide its behavior.
Before installing, understand that strategy details, capital amounts, risk tolerance, and backtest inputs you provide may be sent to gekkoterminal.ai. Avoid sharing sensitive proprietary strategies or private financial details unless you trust that service's data handling. The skill does not itself sign transactions or execute trades.
The skill repeatedly instructs agents to POST strategy parameters to an external endpoint without an explicit privacy or data-handling warning. Users may provide sensitive financial information such as capital amounts, allocations, or proprietary strategy logic, and the omission increases the risk of unintended disclosure to a third-party service.
This example explicitly directs agents to transmit structured user inputs to an external network endpoint. In the context of a DeFi strategy skill, those inputs can include sensitive financial preferences or proprietary trading strategy information, so undisclosed external transmission can expose users to privacy, confidentiality, and data-governance risks.
curl -X POST https://gekkoterminal.ai/api/a2a?agent=strategist \
-H "Content-Type: application/json" \
-d '{
"capability": "develop_strategy",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Develop a strategy
curl -X POST https://gekkoterminal.ai/api/a2a?agent=strategist \
-H "Content-Type: application/json" \
-d '{
"capability": "develop_strategy",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Develop a strategy
curl -X POST https://gekkoterminal.ai/api/a2a?agent=strategist \
-H "Content-Type: application/json" \
-d '{
"capability": "develop_strategy",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Develop a strategy
curl -X POST https://gekkoterminal.ai/api/a2a?agent=strategist \
-H "Content-Type: application/json" \
-d '{
"capability": "develop_strategy",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Usage:
curl -X POST https://gekkoterminal.ai/api/a2a?agent=strategist \
-H "Content-Type: application/json" \
-d '{
"capability": "backtest_strategy",
The Security section says 'Strategist only generates recommendations' and that actual execution requires a separate Executor agent. However, this file also instructs the agent to call an external A2A endpoint to perform capabilities like develop, backtest, adapt, and evaluate strategies, which is more than purely passive local recommendation text and materially affects how the skill operates. This is a documentation-level intent mismatch rather than a clear code-permission issue.
No suspicious patterns detected.