Crypto Executor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:25 AM UTC
• Version: 2.3.4

Overview

This skill is an openly disclosed crypto trading bot, but it can autonomously trade real funds and combines live credentials, persistence, external code execution, and weak safety boundaries.

Review this carefully before installing. Use paper trading or testnet first, pin exact commits and package versions, run in an isolated virtual environment, avoid sourcing secrets into a general shell, disable withdrawals, IP-allowlist Binance keys, and do not enable systemd or cron persistence until you have audited the executor and oracle code and accepted autonomous live trading risk.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T06 · System Persistence

Error

• Location: SYSTEMD_SETUP.md:45

Finding

Persistent Autonomous Trading Service and Scheduled Restart

Content

View full analysis

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: CONFIGURATION.md:225

Finding

Unpinned Remote Dependencies Are Downloaded and Executed with Credential-Bearing Environment

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: executor.py:961

Finding

OCO Failure Fallback Does Not Create a Stop-Loss Order

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: executor.py:1021

Finding

Trailing Stops Are Updated Only in Local State and Not on Binance

Content

View full analysis

position.get('trailing_stop', 0): position['trailing_stop'] = new_trailing print(f"[TRAIL] {position['symbol']} trailing stop → ${new_trailing:.2f}") self.portfolio.save_state() ``` ### Technical Analysis The function calculates a new trailing-stop value and writes it to local JSON state, but it does not cancel, replace, or amend any Binance order. No API call is made after `new_trailing` is calculated. Consequently, the exchange-side OCO order remains at its original stop price while the local application reports a higher trailing stop. If the process stops, loses connectivity, or the market reverses, Binance can enforce only the original order—not the locally recorded value. This is especially dangerous because the README and Skill description advertise trailing stops as automatically locking profits. The implementation creates a material discrepancy between documented protection, local state, and actual exchange state. ### Attack Path 1. A position is opened with an initial Binance OCO stop. 2. The market moves favorably. 3. `calculate_trailing_stop` returns a higher stop price. 4. The application updates `open_positions.json` and prints a successful trailing-stop message. 5. No exchange-side order is updated. 6. The market reverses, or the bot loses connectivity or terminates. 7. Binance executes only the origin ...[truncated 794 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (115)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · executor.py (reported line 40)May include surrounding context.

python

""

import sys
import json
import os
import time
import subprocess
import threading
from datetime import datetime, timedelta
from pathlib import Path
import urllib.request
import urllib.error
import hashlib
import hmac
import concurrent.futures
from collections import deque

# ==========================================
# CONFIGURATION
# ==========================================
BINANCE_API_KEY = os.getenv("BINANCE_API_KEY")
BINANCE_API_SECRET = os.getenv("BINANCE_API_SECRET")
TELEGRAM_BOT_TOKEN = os.getenv("TELEGRAM_BOT_TOKEN")
TELEGRAM_CHAT_ID = os.getenv("TELEGRAM_CHAT_ID")

WORKSPACE = Path("/workspace")
ORACLE_SCRIPT = Path("/workspace/skills/crypto-sniper-oracle/crypto_oracle.py")
PROJECTS_FILE = WORKSPACE / "trading_projects.json"
PORTFOLIO_FILE = WORKSPACE / "portfolio_state.json"
TRADES_LOG = WORKSPACE / "trades_history.jsonl"
POSITIONS_FILE = WORKSPACE / "open_positions.json"
PERFORMANCE_FILE = WORKSPACE / "performance_metrics.json"
REPORTS_DIR = WORKSPACE / "reports" / "dail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The guide instructs storing live Binance and Telegram credentials in a plaintext environment file on disk. Even with restrictive permissions, plaintext secret storage increases the blast radius of host compromise, backups, misconfiguration, and accidental disclosure, especially for a bot that can trade real funds.

Content

Scanner excerpt · CONFIGURATION.md (reported line 164)May include surrounding context.

bash

# Create secure credentials file
sudo mkdir -p /etc/crypto-executor
sudo nano /etc/crypto-executor/credentials.env

# Content:
BINANCE_API_KEY=your_binance_api_key

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The documentation tells users or agents to source a file containing exchange and messaging secrets into the current shell environment. That exposes credentials broadly to subprocesses, shell inspection, crash dumps, and any subsequently executed external code, including the separately installed oracle dependency.

Content

Scanner excerpt · CONFIGURATION.md (reported line 185)May include surrounding context.

To use:

bash

# Load before running bot
source /etc/crypto-executor/credentials.env

# Or use with systemd (see SYSTEMD_SETUP.md)
EnvironmentFile=/etc/crypto-executor/credentials.env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

Referencing the same plaintext credential file from systemd continues the design of storing high-value API secrets in a locally readable file. While common operationally, it remains sensitive because compromise of the host or service configuration can reveal live trading credentials.

Content

Scanner excerpt · CONFIGURATION.md (reported line 188)May include surrounding context.

source /etc/crypto-executor/credentials.env

Or use with systemd (see SYSTEMD_SETUP.md)

EnvironmentFile=/etc/crypto-executor/credentials.env

text

**Why this is better:**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

This is another explicit instruction to source live API credentials into the shell before launching the bot. In context, that is especially risky because the same guide later encourages cloning and executing additional code, increasing the chance that secrets leak to child processes or malicious dependencies.

Content

Scanner excerpt · CONFIGURATION.md (reported line 382)May include surrounding context.

md

# Load credentials into current session
# Why: executor.py reads these via os.getenv() at startup.
#      Without them, bot exits immediately with [ERROR] Missing Binance credentials
source /etc/crypto-executor/credentials.env

# Verify credentials loaded
echo "API Key set: ${BINANCE_API_KEY:0:8}..."   # Shows first 8 chars only (security)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

This example workflow normalizes an agent loading real exchange credentials and immediately executing the trading bot, reinforcing an unsafe autonomous path with direct access to funds. Combined with persistence and external dependency installation, it materially raises the risk of unauthorized trades or credential abuse if any part of the chain is compromised.

Content

Scanner excerpt · CONFIGURATION.md (reported line 458)May include surrounding context.

md

Runs: ls /workspace/skills/crypto-executor/executor.py
↓
✅ File exists → skips installation entirely
   Runs: source /etc/crypto-executor/credentials.env
   Runs: python3 /workspace/skills/crypto-executor/executor.py
↓
Bot starts in <5 seconds, loads learned_config.json automatically

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The instructions explicitly source a credentials file into the shell environment before executing the trading bot, exposing high-value Binance API secrets to the process environment. In combination with shell, file, and network capabilities, this creates a strong path for credential misuse, accidental leakage, or unauthorized live trading if the skill or its dependencies are compromised.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md

ls /workspace/skills/crypto-executor/executor.py

# ✅ Already installed → just launch:
source /etc/crypto-executor/credentials.env
python3 /workspace/skills/crypto-executor/executor.py

# ❌ Not installed → full install (run once):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CONFIGURATION.md (reported line 178)May include surrounding context.

md

WorkingDirectory=/workspace/skills/crypto-executor

# Credentials — loaded from secure file (see Security section below)
# Create /etc/crypto-executor/credentials.env first (chmod 600, root-owned)
EnvironmentFile=/etc/crypto-executor/credentials.env

# Execution

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CONFIGURATION.md (reported line 179)May include surrounding context.

md

WorkingDirectory=/workspace/skills/crypto-executor

# Credentials — loaded from secure file (see Security section below)
# Create /etc/crypto-executor/credentials.env first (chmod 600, root-owned)
EnvironmentFile=/etc/crypto-executor/credentials.env

# Execution

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CONFIGURATION.md (reported line 375)May include surrounding context.

md

WorkingDirectory=/workspace/skills/crypto-executor

# Credentials — loaded from secure file (see Security section below)
# Create /etc/crypto-executor/credentials.env first (chmod 600, root-owned)
EnvironmentFile=/etc/crypto-executor/credentials.env

# Execution

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SYSTEMD_SETUP.md (reported line 64)May include surrounding context.

md

WorkingDirectory=/workspace/skills/crypto-executor

# Credentials — loaded from secure file (see Security section below)
# Create /etc/crypto-executor/credentials.env first (chmod 600, root-owned)
EnvironmentFile=/etc/crypto-executor/credentials.env

# Execution

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SYSTEMD_SETUP.md (reported line 65)May include surrounding context.

md

WorkingDirectory=/workspace/skills/crypto-executor

# Credentials — loaded from secure file (see Security section below)
# Create /etc/crypto-executor/credentials.env first (chmod 600, root-owned)
EnvironmentFile=/etc/crypto-executor/credentials.env

# Execution

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SYSTEMD_SETUP.md (reported line 340)May include surrounding context.

md

WorkingDirectory=/workspace/skills/crypto-executor

# Credentials — loaded from secure file (see Security section below)
# Create /etc/crypto-executor/credentials.env first (chmod 600, root-owned)
EnvironmentFile=/etc/crypto-executor/credentials.env

# Execution

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SYSTEMD_SETUP.md (reported line 352)May include surrounding context.

md

WorkingDirectory=/workspace/skills/crypto-executor

# Credentials — loaded from secure file (see Security section below)
# Create /etc/crypto-executor/credentials.env first (chmod 600, root-owned)
EnvironmentFile=/etc/crypto-executor/credentials.env

# Execution

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SYSTEMD_SETUP.md (reported line 353)May include surrounding context.

md

WorkingDirectory=/workspace/skills/crypto-executor

# Credentials — loaded from secure file (see Security section below)
# Create /etc/crypto-executor/credentials.env first (chmod 600, root-owned)
EnvironmentFile=/etc/crypto-executor/credentials.env

# Execution

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SYSTEMD_SETUP.md (reported line 361)May include surrounding context.

md

WorkingDirectory=/workspace/skills/crypto-executor

# Credentials — loaded from secure file (see Security section below)
# Create /etc/crypto-executor/credentials.env first (chmod 600, root-owned)
EnvironmentFile=/etc/crypto-executor/credentials.env

# Execution

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The statement that the root-owned credentials file can be 'shared with manual runs' using source /etc/crypto-executor/credentials.env encourages loading exchange API keys directly into an interactive shell environment. That increases the chance of accidental exposure through shell history, debugging output, inherited subprocess environments, or operator misuse.

Content

Scanner excerpt · SYSTEMD_SETUP.md (reported line 371)May include surrounding context.

md

- ✅ Credentials not visible in `systemctl status` output
- ✅ File protected chmod 600 (root only)
- ✅ Not exposed in process list (`ps aux`)
- ✅ Shared with manual runs: `source /etc/crypto-executor/credentials.env`

---

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The notifier sends trade execution and performance details to Telegram, a third-party service, without any guardrail to minimize shared data or require explicit informed consent at the point of use. In a financial trading skill, external transmission of holdings, positions, and performance can leak sensitive financial activity and operational patterns outside the local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill places live market and OCO orders automatically with no explicit user confirmation, dry-run default, or mandatory safety interlock. In a plugin/agent context, autonomous trade execution against real exchange credentials is highly dangerous because any bad signal, poisoned dependency, or logic flaw immediately affects real funds.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · CONFIGURATION.md (reported line 21)May include surrounding context.

md

## 🚀 Step 1: Binance API Setup

### **Create API Key**

1. Login to https://binance.com
2. Profile → API Management

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · CONFIGURATION.md (reported line 82)May include surrounding context.

md

# Method 1: Use bot
# 1. Send any message to your bot
# 2. Visit (replace YOUR_TOKEN):
https://api.telegram.org/botYOUR_TOKEN/getUpdates

# 3. Find "chat":{"id":123456789}
# 4. Save CHAT_ID

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · CONFIGURATION.md (reported line 103)May include surrounding context.

md

# Method 1: Use bot
# 1. Send any message to your bot
# 2. Visit (replace YOUR_TOKEN):
https://api.telegram.org/botYOUR_TOKEN/getUpdates

# 3. Find "chat":{"id":123456789}
# 4. Save CHAT_ID

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · CONFIGURATION.md (reported line 178)May include surrounding context.

DRAWDOWN_KILL_PCT=10

Secure the file

sudo chmod 600 /etc/crypto-executor/credentials.env sudo chown root:root /etc/crypto-executor/credentials.env

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · CONFIGURATION.md (reported line 192)May include surrounding context.

DRAWDOWN_KILL_PCT=10

Secure the file

sudo chmod 600 /etc/crypto-executor/credentials.env sudo chown root:root /etc/crypto-executor/credentials.env

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SYSTEMD_SETUP.md (reported line 352)May include surrounding context.

DRAWDOWN_KILL_PCT=10

Secure the file

sudo chmod 600 /etc/crypto-executor/credentials.env sudo chown root:root /etc/crypto-executor/credentials.env

text

Static analysis

No suspicious patterns detected.