T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:38- Finding
Persistent Instruction and Output Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Decker AI 트레이딩
Security checks for vulnerabilities and agentic risk
Overview
This trading skill is coherent, but it needs review because it can initiate account-linked trading workflows with broad triggers, external data sharing, and an unsafe secret-in-URL order request pattern.
Review carefully before installing. Use only least-privilege exchange API keys, never a primary wallet private key, and assume Decker may receive your messages, Slack identifiers, portfolio/trading requests, and order parameters. Do not enable live trading or auto-order rules until you understand whether the account is simulated or real, how approvals work, and how to revoke keys and disable automation.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:416- Finding
Shared Authentication Secret Transmitted in a GET Query String
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:275- Finding
Unminimized External Disclosure of User Messages and Slack Identifiers
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (17)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The trigger list includes extremely common greetings and generic phrases, making the skill likely to activate in conversations that are not actually about trading. In a skill that can initiate order workflows and handle account-linked actions, over-broad invocation materially increases the chance of unintended execution paths, user confusion, or coercive social engineering through accidental activation.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md - TSLA, 테슬라 → TSLA - NVDA, 엔비디아 → NVDA ## Output Rules (EVClaw 패턴) - **시그널 응답**: compact, 진입/목표/손절 포함, "🍗 치킨먹자?" CTA - **포트폴리오**: "총 평가액 X USDT, 손익 Y (Z%), 보유 N개" 한 줄 요약
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The markdown advertises trading and auto-order capabilities but provides no visible warnings about financial risk, execution consequences, or the distinction between informational responses and live trading actions. In the context of an agent skill for portfolio and exchange integration, this omission makes harmful user misunderstanding more likely and increases the chance of accidental real-money impact.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The repeated '말만 하면' guidance encourages the model to treat broad natural-language input as sufficient for activation without clearly delimiting when the skill should or should not run. That ambiguity is risky here because the skill includes trading, auto-order, and portfolio operations, so loose activation semantics can cause the wrong tool flow to be selected.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs users to connect live exchange API keys and even DEX private keys, but it does not present a prominent, repeated risk warning proportional to the danger of granting trading authority. Because this skill supports order execution and auto-ordering, insufficient safety framing can lead users to expose high-value credentials or enable unintended live trading with real financial loss.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - GET .../liquidations/summary-by-symbol?interval=24h → symbols별 bias 8. **헬스체크**: "Decker 상태 확인해줘" - GET https://api.decker-ai.com/api/v1/system/health ## 인증 필요 엔드포인트 (JWT 필요)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - GET .../liquidations/summary-by-symbol?interval=24h → symbols별 bias 8. **헬스체크**: "Decker 상태 확인해줘" - GET https://api.decker-ai.com/api/v1/system/health ## 인증 필요 엔드포인트 (JWT 필요)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 99% confidence
- Finding
The skill embeds an internal order-request URL template that includes a secret in the query string together with user ID, symbol, side, and quantity. Query-string secrets are highly dangerous because they are commonly logged, cached, and exposed through telemetry or debugging, and here the endpoint can trigger trading actions, creating a serious risk of credential leakage and unauthorized order placement.
- Content
md 1. **파싱**: symbol(ETH/BTC 등), side(buy/sell), quantity(숫자), **slack_user_id = Conversation info의 sender_id** 2. **호출**: web_fetch **GET만 지원** (POST 불가) - **URL 형식**: `https://api.decker-ai.com/api/v1/link/slack/order-request?slack_user_id={sender_id}&symbol=ETH&side=buy&quantity=0.01&openclaw_secret={OPENCLAW_SECRET}` - slack_user_id, symbol, side, quantity, openclaw_secret **모두 쿼리에 포함 필수** 3. **응답**: "승인 요청이 Slack으로 발송되었습니다. 승인/취소 버튼을 확인해 주세요."
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
설치
bash mkdir -p ~/.openclaw/skills/decker/references cp docs/openclaw_skills/decker/SKILL.md ~/.openclaw/skills/decker/ cp docs/openclaw_skills/decker/references/API_QUICK.md ~/.openclaw/skills/decker/references/
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
설치
bash mkdir -p ~/.openclaw/skills/decker/references cp docs/openclaw_skills/decker/SKILL.md ~/.openclaw/skills/decker/ cp docs/openclaw_skills/decker/references/API_QUICK.md ~/.openclaw/skills/decker/references/
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The guide encourages users to enable automatic trading based on signals and notes that it starts in simulated trading, but it does not clearly warn that similar workflows may later affect real accounts, incur losses, or require explicit user understanding of account/trading risk. In a finance/trading skill, omission of risk and account-impact warnings can mislead inexperienced users into unsafe automation behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The order example instructs users to submit a buy request for a specific asset amount but provides no accompanying warning that placing orders can affect balances, positions, and financial exposure. Even with an approval flow, normalizing trade commands without a risk notice is dangerous in a skill that can route users toward account-linked trading actions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Line L03 is written as a mandatory instruction in Korean and dictates how responses must be phrased, without indicating any user opt-in or alternative locale support. This creates a language/locale policy concern because it appears to force a specific language context rather than offering a choice.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The examples include direct order and auto-order requests like buying, selling, disabling, and configuring automated trading without showing any gating conditions, confirmation requirements, or authentication checks. In a skill tied to real trading operations, loose trigger matching for high-impact actions can lead to unintended order placement or unauthorized automation changes.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document maps very broad greeting/onboarding prompts such as '하이' and '안녕' to this trading skill, which increases the chance of unintended invocation. In a skill that can expose portfolio data or initiate trading-related flows, accidental routing from generic conversation can cause users to receive sensitive financial actions or prompts in the wrong context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This file presents all user-facing guidance in Korean and does not indicate that language selection is optional or that the skill is intended only for a Korean-speaking audience. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The file presents all visible user-facing trigger examples and headings in Korean, with no indication that another language can be used or that Korean is a documented requirement. If this skill is intended for a broader audience, this creates a language-policy concern because the locale is effectively fixed without explicit opt-in or justification.
- Content
Static analysis
No suspicious patterns detected.