Vincent - Trading Engine

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:45 PM UTC
• Version: 1.0.69

Overview

This skill is openly for automated trading, but it asks agents to run a mutable third-party CLI with wallet-linked authority and broad file access, which warrants careful review before use.

Review this skill before installing. Use only with a revocable, least-privilege trading key, strict server-side trade limits, and explicit approval thresholds. Prefer a pinned, vetted `@vincentai/cli` version or preinstalled binary, and avoid granting broad filesystem access unless the runtime can confine it to the required wallet reference and working directory.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:8
• Finding: Mutable Third-Party CLI Is Downloaded and Executed Without Version or Integrity Pinning<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:8` and `SKILL.md:91-93` (the mutable command pattern is repeated throughout the file) **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code ```yaml allowed-tools: Read, Write, Bash(npx:@vincentai/cli*) ``` ```bash npx @vincentai/cli@latest trading-engine create-strategy \ --key-id <KEY_ID> \ --name "BTC Momentum" \ ``` ### Technical Analysis The Skill authorizes execution of the third-party `@vincentai/cli` npm package and consistently instructs the agent to invoke its mutable `latest` release. The project contains no pinned package version, lockfile, package integrity hash, signature-verification procedure, or local implementation that would allow the executed payload to be fully audited. When the package is not already available locally, `npx` can retrieve it and its transitive dependencies from the npm registry and immediately execute them. The effective code can therefore change after this Skill has been reviewed. The wildcard in `Bash(npx:@vincentai/cli*)` also permits every subcommand exposed by the package rather than limiting execution to the minimum set of audited trading-engine operations. This is particularly sensitive because the CLI is used in a context involving wallet authorization, automated financial transactions, strategy configuration, and access to local credential-related state. The statements in the documentation that private keys remain on Vincent's servers and that policies are enforced cannot be independently verified from this project because the CLI and backend implementations are not included. ### Attack Path 1. An attacker compromises the npm publisher account, the package release process, a transitive dependency, or another component in the package distribution chain. 2. The attacker publishes a malicious release that becomes the version resolved by `@vincentai/cli@latest`. 3. ...[truncated 1266 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@vincentai/cli@latest` with an exact, reviewed version in every command, such as `@vincentai/cli@1.2.3`. 2. Install the CLI during a controlled build or deployment phase rather than downloading executable code at Skill runtime. 3. Commit and enforce a lockfile covering the package and all transitive dependencies. 4. Verify package integrity with trusted hashes or signed provenance before installation and execution. 5. Run the CLI in a sandbox with no access to unrelated files, environment variables, network destinations, or credentials. 6. Restrict the Bash allowlist to the specific required subcommands and arguments rather than allowing `npx:@vincentai/cli*`. 7. Use a dedicated, revocable, least-privilege trading credential with server-side limits on venues, instruments, transaction sizes, daily exposure, and spending. 8. Vendor or otherwise make the security-relevant CLI implementation available for review, especially credential resolution, network destinations, policy enforcement, and transaction construction. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:8
• Finding: Wallet Credential Context Is Combined With Unrestricted Filesystem Read and Write Capabilities<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:8` and `SKILL.md:17-20` **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: Read, Write, Bash(npx:@vincentai/cli*) ``` ```yaml metadata: clawdbot: homepage: https://heyvincent.ai requires: config: - ${OPENCLAW_STATE_DIR:-$HOME/.openclaw}/credentials/agentwallet - ./agentwallet ``` ### Technical Analysis The Skill declares unrestricted `Read` and `Write` tools while also requiring wallet-related configuration from either a global credential directory or a project-local `agentwallet` path. The documented trading workflows need access to a trading authorization reference and the ability to invoke specific API operations, but they do not demonstrate a legitimate need for arbitrary filesystem reads or writes. This exceeds least privilege because a component executing in the Skill context may be able to inspect unrelated files available to the agent or modify local state outside the trading task. The risk is amplified by the use of a remotely resolved third-party CLI whose implementation is not present in the audited project. The file does not explicitly instruct the agent to read and transmit raw credential contents, and no direct private-key exfiltration command was found. Nevertheless, combining credential-path availability, broad filesystem tools, arbitrary package execution, and network-enabled trading operations creates an avoidable privilege boundary failure. ### Attack Path 1. The Skill is loaded with access to one of the declared `agentwallet` configuration paths. 2. A compromised CLI package, malicious transitive dependency, or manipulated workflow runs through the permitted Bash capability. 3. The executing component uses the broadly available read capability or its process-level access to inspect wallet configuratio ...[truncated 1291 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the general `Write` capability unless a specific documented operation requires it. 2. Replace unrestricted `Read` access with access limited to a dedicated wallet key reference or narrowly scoped configuration file. 3. Do not expose raw wallet secrets to the Skill. Use an opaque, revocable credential handle backed by a trusted local broker or operating-system secret store. 4. Ensure the project-local `./agentwallet` path cannot be substituted through symlinks or attacker-controlled working directories. 5. Run the CLI under a dedicated operating-system identity with filesystem access limited to the minimum necessary files. 6. Restrict outbound traffic to documented Vincent endpoints and block arbitrary network destinations. 7. Apply server-side transaction allowlists, per-trade limits, daily spending limits, approval thresholds, and emergency revocation. 8. Require explicit user confirmation for position creation, strategy activation, and other financially consequential operations. 9. Audit credential reads, configuration writes, destination hosts, and transaction requests without logging raw secrets. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (45)

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

## Security Model

- **LLM cannot bypass policies** — all trades go through the venue's policy-enforced skill (`polymarketSkill.placeBet()` or `hyperliquidSkill.trade()`) which enforces spending limits, approval thresholds, and allowlists
- **Backend-side LLM key** — the OpenRouter API key never leaves the server. Agents and users cannot invoke the LLM directly
- **Credit gating** — no LLM invocation without sufficient credit balance
- **Tool constraints** — the LLM's available tools are controlled by the strategy's `config.tools` settings. If `canTrade: false`, the trade tool is not provided

• Confidence: 90% confidence
• Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill promotes automated trading, stop-loss, take-profit, and trailing-stop execution but does not place a clear upfront warning about financial loss, unintended execution, slippage, or automation errors. In this context, users may be induced to enable autonomous trading without appreciating that monitoring failures, bad thresholds, or model mistakes can still cause real losses despite stated policy controls.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This command uses `npx @vincentai/cli` without pinning an exact package version, so execution may fetch and run whatever version is current at invocation time. In a trading skill with Bash access and wallet-linked credentials, a compromised or malicious package update could directly influence trade execution or exfiltrate sensitive data.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The skill instructs the agent to execute an unpinned `npx @vincentai/cli` command, which introduces supply-chain risk because the resolved package can change over time. Since this skill manages automated trading and interacts with credential material, compromise of the package source could lead to unauthorized trades or credential exposure.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: An unpinned `npx` package allows arbitrary future code from the npm registry to be executed when the command runs. In the context of financial automation, even a brief compromise window could be used to alter strategy parameters, place trades, or harvest API-linked wallet information.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: Because `npx @vincentai/cli` is not pinned here, the command may execute a newer or tampered package than the author intended. This is particularly dangerous for a skill that can activate automated strategies and issue actions against trading backends.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The command relies on an unversioned npm package at execution time, creating a classic supply-chain execution risk. If the registry package is hijacked or unexpectedly changed, the agent could run attacker-controlled code with access to trading operations.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This unpinned `npx` command can resolve to different code over time, undermining reproducibility and trust. Given the autonomous trading context, a malicious update could manipulate positions, disable protections, or siphon usage data.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: Running an unpinned npm CLI at command time exposes the agent to remote code execution through dependency or publisher compromise. The surrounding skill is especially sensitive because it can pause/resume/archive strategies tied to real financial positions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The skill example executes a package from npm without version pinning, allowing silent drift or malicious replacement. In a trading engine, that can translate into direct financial loss through unauthorized strategy lifecycle changes or malicious trade actions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This command exposes the agent to execution of mutable third-party code by using `npx @vincentai/cli` without an exact version. The impact is elevated because the command can duplicate strategies and preserve privileged trading configuration automatically.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: Unpinned package execution here allows whatever package version npm resolves at the time of use, which is a supply-chain risk. Since this command views invocation history in a system that records prompts and actions, a compromised CLI might also exfiltrate sensitive logs.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: Even though this command is read-oriented, using an unpinned `npx` package still permits arbitrary code execution from a mutable source. A compromised CLI could falsify cost data, steal key identifiers, or prepare later abuse.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This performance query still executes remote package code without version control, which is unsafe in any privileged environment. In a financial setting, tampered output could mislead operators into making risky decisions or hide malicious activity.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The command creates strategies through an unpinned package, which creates direct exposure to malicious package updates. Because this endpoint can define automated monitoring and later trading behavior, compromise at creation time can persist through the strategy lifecycle.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: Worker status retrieval still runs mutable npm code because the package is unpinned. Even read-only commands are dangerous in an environment with linked credentials and localhost service access, as the package can execute arbitrary pre/post-install logic.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This rule-creation command uses an unpinned package while configuring automated sell behavior, so a tampered package could alter thresholds or create hidden actions. The impact is substantial because rule execution can materially affect live positions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The HyperLiquid rule creation example also relies on an unpinned npm package, which could be replaced or modified upstream. That creates a direct path from supply-chain compromise to unauthorized derivatives risk management actions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: Creating take-profit rules through an unpinned package allows upstream package compromise to influence when and how positions are exited. In automated trading, small parameter changes can produce immediate financial consequences.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This command configures HyperLiquid take-profit behavior while executing a mutable npm package. The combination of derivatives trading and remote package resolution materially increases risk of account-impacting abuse.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: Trailing stop creation via unpinned `npx` permits arbitrary upstream code execution in a path that directly affects liquidation timing. In volatile markets, manipulated trailing parameters could rapidly lock in losses or prevent intended protection.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The HyperLiquid trailing stop command carries the same supply-chain risk through an unpinned npm resolution path. Because it targets leveraged products, unauthorized changes can have amplified financial effects.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: Listing rules is a read operation, but the unpinned package still grants arbitrary code execution during invocation. In context, the CLI may access key IDs and local service endpoints that an attacker-controlled package could abuse.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: Filtering rule listings through an unpinned package still exposes the host to mutable third-party code. A malicious package could conceal rules, misreport status, or gather credential-related metadata.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: Updating a rule through an unpinned CLI package creates a direct route for unauthorized modification of protective price thresholds. In a live trading system, compromised rule updates can immediately increase exposure or defeat risk controls.

Static analysis

No suspicious patterns detected.