Security audit

Ninjatrader Dev

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a NinjaTrader coding reference, but it includes hardcoded SSH deployment commands that could copy or overwrite trading strategy files on a remote machine if followed.

Review the deployment section before installing. Only use the SSH/SCP commands after replacing `gmdeep` and the Windows path with a user-approved destination, confirming the remote identity, checking for overwrite risk, and keeping strategy activation or live trading as a separate approval step.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:355
Finding: Hardcoded Environment-Specific SSH Deployment Target
Content: View full analysis
Remediation: View remediation
:/" ``` 3. Require the agent to obtain explicit user confirmation immediately before any network transfer. The confirmation should display: - The resolved hostname or IP address. - The remote username. - The complete destination path. - The source filename. - Whether an existing destination file may be overwritten. 4. Verify the SSH host key and destination identity before transferring files. 5. Use a dedicated, least-privileged deployment account restricted to the intended strategy directory. 6. Prevent accidental overwrites by checking for the destination file first and creating a backup only after user approval. 7. Keep environment-specific deployment procedures in private, local documentation rather than in a publicly distributed skill. 8. Treat compilation and strategy activation as separate approval-gated operations, particularly where deployment could affect live trading. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is presented as a development reference, but it also includes concrete SSH/SCP commands for copying strategy files onto a remote host. That expands the skill from passive reference material into operational remote-system modification guidance, which can cause unintended changes to external systems if invoked automatically or without explicit user confirmation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The SSH/SCP section gives direct remote file-copy and verification commands without an explicit warning that they will modify a remote Windows system. In an agent context, omission of a clear warning and consent checkpoint makes it easier for users or automation to perform remote changes unintentionally.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The usage trigger says to use this skill for NT8 NinjaScript work in general, which is broad enough to activate in ordinary coding contexts. Because the skill also contains deployment instructions, an overly broad trigger increases the chance that remote modification guidance is surfaced when the user only asked for code help or reference information.
Content: No source excerpt is available for this finding.