Security audit

Smart Agent Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed trading skill, but it can run every 15 minutes and place repeated live trades without built-in exposure or duplicate-order safeguards.

Install only if you understand this can place live trades when RUN_LIVE=true or --live is used. Keep it in dry-run until you add position limits, duplicate-order protection, daily spend caps, and pinned dependencies, and use a restricted AION key with external account-level limits.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: clawhub.json:4
Finding: Unpinned Executable Dependencies Create a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: trade_thesis.py:292
Finding: Scheduled Live Trading Lacks Cumulative Exposure and Duplicate-Order Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest explicitly states that the skill performs market reads and trade execution and includes a RUN_LIVE toggle, yet it provides no prominent warning about real-money financial impact, automated execution risk, or potential loss. Because this is a trading skill intended for periodic automation, the missing disclosure materially increases the risk that a user enables live operation without understanding that the agent may place real trades on its own.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documents use of environment-based credentials (AION_API_KEY) and an executable workflow, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, missing scope declarations can cause the runtime to grant broader-than-necessary access or leave reviewers unable to verify what the skill is permitted to read, which is especially risky for a trading skill handling API keys and live execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The publishing command uses npx clawhub@latest, which is not a pinned version and will execute whatever package version is current at runtime. If the upstream package is compromised or a breaking/malicious release is published, operators could execute attacker-controlled code during publish/install workflows.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The installation example again invokes npx clawhub@latest, creating the same supply-chain risk during installation or verification. Because this skill is for automated market trading, compromise of the install path could be used to steal API keys, alter strategy code, or trigger unauthorized trades.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest enables managed automated execution on a 15-minute cron for a skill whose purpose includes live trade execution, but it does not constrain activation with explicit safety gates, simulation defaults, or human approval requirements. In this context, broad unattended scheduling increases the chance of unintended or repeated financial transactions if configuration is unsafe, defaults are misused, or the strategy behaves unexpectedly.
Content: No source excerpt is available for this finding.