Security audit

Nofa Backtest

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent API documentation, but it has review-worthy risks around credential handling, mixed API hostnames, long-running sessions, and automatic paid XRPL payment examples.

Review before installing. Use only low-value test wallets for x402 examples, do not send real NOFA API keys to staging unless the publisher clearly documents separate staging credentials, store bearer tokens in a protected secret store or a 0600 file, and stop dry-run sessions when finished.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:486
Finding: Unpinned Third-Party Packages Handle Financial Signing Operations
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:62
Finding: Bearer API Key Is Recommended for Storage in an Unprotected Plaintext File
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence

Findings (14)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly instructs users to send API keys only to api-dev.reclaw.xyz, then later references authenticated usage against api-staging.reclaw.xyz. This contradictory guidance undermines trust boundaries and can cause agents or users to disclose bearer credentials to an unintended environment, including less protected staging infrastructure.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
⚠️ CRITICAL: Save your api_key immediately! This is the only time you will see it. The key is generated locally and cannot be retrieved later.

Recommended: Save your credentials to ~/.config/nofa/credentials.json:

json
{

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The x402 example sets Authorization with the NOFA API key while targeting https://api-staging.reclaw.xyz, directly conflicting with the earlier warning that keys must only be sent to api-dev.reclaw.xyz. Because bearer tokens are reusable credentials, this can leak identity and API access to the wrong environment or normalize unsafe exfiltration patterns for agents.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 805)May include surrounding context.
md
> **File**: `references/strategy-generator.md` — load this skill alongside `SKILL.md` for full strategy generation + backtest workflow.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.
md
## Features - **Strategy Builder**: Create trading strategies using decision trees (IF/THEN logic) - **Technical Indicators**: RSI, EMA, MA, MACD, Bollinger Bands, ADX, and more - **Backtesting**: Run historical backtests with custom parameters - **Dry-Run Trading**: Launch simulated trading sessions (no real money, no exchange key needed)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
Register your agent directly - no authentication needed:

bash
curl -X POST ${BASE_URL}/agents/register \ -H "Content-Type: application/json" \ -d '{"name": "YourAgentName", "description": "What your agent does"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 308)May include surrounding context.
Check if a strategy tree is valid before running backtest:

bash
curl -X POST ${BASE_URL}/backtest/validate \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The dry-run feature creates long-lived server-side trading sessions and exposes control and monitoring endpoints, but the skill does not adequately warn that sessions persist until stopped and may consume remote resources or potentially billable features. Agents may start sessions opportunistically and leave them running, causing unintended resource use, costs, or account clutter.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation criteria are very broad and include generic phrases like "create strategy" and "design a trading system," which can cause the skill to trigger in contexts the user did not clearly intend. In an agent setting, ambiguous auto-activation can lead to inappropriate strategy-generation behavior and downstream actions such as preparing backtest requests without sufficiently explicit user consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The output specification requires a "Human-readable strategy explanation (English description of logic + risk parameter summary)," which forces a specific language regardless of the user's language preference. This is reinforced later by the instruction that the human-readable section should use English, with no opt-in or alternative locale support.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to call an external backtest API with user-supplied strategy data, symbols, and timing parameters, but does not require a clear disclosure or consent flow before transmission. In a tool-using agent, this can result in silent exfiltration of user-provided trading logic or sensitive proprietary strategy information to an external service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instruction "The human-readable section should use English" enforces a fixed output language. There is no accompanying user choice, locale selection, or documented justification for restricting responses to English only.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest advertises payment-required XRPL endpoints but does not clearly warn that invoking them can trigger paid blockchain transactions or consume funds. In an autonomous agent context, that omission is dangerous because an agent may call these endpoints during normal tool use without presenting cost, consent, or spending boundaries to the user.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest explicitly states that registration is public and that an API key is generated immediately, but it does not include any warning to securely store, avoid logging, or avoid exposing that credential. In an agent setting, newly issued secrets are often echoed, persisted in traces, or handled automatically, which increases the chance of accidental credential disclosure and later unauthorized API use.
Content: No source excerpt is available for this finding.