Quant Trading CN

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:51 PM UTC
• Version: 1.0.0

Overview

This trading skill is mostly documentation, but it includes high-impact live-trading guidance that could close positions or cancel orders without strong safeguards.

Review carefully before installing or using this with real broker credentials. Keep it to paper trading or read-only analysis unless you add explicit live-trading opt-in, per-order ownership checks, dry-run previews, confirmation gates, and strict limits on which files and broker resources the assistant may touch.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/README_en.md:24

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/KNOWLEDGE_en.md:1114

Finding

Signal Handler Can Liquidate Positions and Cancel Unrelated Orders Without Confirmation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/NUANCES_en.md (reported line 50)May include surrounding context.

md

- Most stocks: ₹0.05
  - High-priced stocks (>₹1000): ₹5.00
  - Penny stocks: ₹0.01
- Zerodha rejects order INSTANTLY, no warning

**Token Cost:** Debugging this without knowing: 500-1000 tokens per conversation

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/README_en.md (reported line 173)May include surrounding context.

For live trading, create a .env file in your bot directory:

bash

# Create .env file (never commit this!)
cat > .env << EOF
KITE_API_KEY=your_api_key
KITE_API_SECRET=your_api_secret

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/README_en.md (reported line 174)May include surrounding context.

For live trading, create a .env file in your bot directory:

bash

# Create .env file (never commit this!)
cat > .env << EOF
KITE_API_KEY=your_api_key
KITE_API_SECRET=your_api_secret

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The title and description present the skill as Chinese-language only ("Quant Trading CN" and Chinese text) with no indication that users can choose another language or that the locale restriction is required for a region-specific purpose. This is a natural-language policy concern because it implicitly enforces a language/locale without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill title, instructions, examples, and warnings are presented entirely in Chinese, while the manifest does not state that the skill is intentionally limited to Chinese-speaking users or offer an alternative language option. This can violate language/locale policy because it imposes a specific language without explicit user opt-in or a documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description explicitly presents the skill as a Chinese-language expert ("量化交易专家") while the file provides no indication that users can choose another language or locale. This can violate language/locale policy because it imposes a specific language experience without opt-in or a clearly documented region-specific justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/NUANCES_en.md (reported line 34)May include surrounding context.

The Fix:

python

# Download instruments.csv from Zerodha
instruments = pd.read_csv("https://api.kite.trade/instruments")
tick_size = instruments[instruments['tradingsymbol'] == 'RELIANCE']['tick_size'].values[0]

# Round ALL prices to tick multiples

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/NUANCES_en.md (reported line 1008)May include surrounding context.

The Fix:

python

# Download instruments.csv from Zerodha
instruments = pd.read_csv("https://api.kite.trade/instruments")
tick_size = instruments[instruments['tradingsymbol'] == 'RELIANCE']['tick_size'].values[0]

# Round ALL prices to tick multiples

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file includes concrete examples for placing live orders and performing emergency market exits in a real trading context, but it does not accompany those examples with a clear warning that they can trigger real-money transactions and losses if copied into production. In a trading skill, operational snippets are especially sensitive because users may paste them directly into bots or assistants that interface with broker APIs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 82% confidence

Finding

The README instructs users to run npx skills add javajack/skill-algotrader without pinning an exact package/version, which allows whatever package version is current at install time to execute on the user's machine. That creates a supply-chain risk: a compromised upstream package, typo-squatted dependency, or malicious future release could run arbitrary code during installation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The documentation expands the skill from strategy generation/backtesting into scanning arbitrary local trading code and offering to auto-apply fixes. A skill that inspects and modifies user files increases the attack surface substantially, because it may read sensitive project content and make unsafe or destructive changes if guardrails, scope restrictions, and explicit approval mechanisms are not enforced.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The disclaimer claims the skill will not execute trades without user confirmation, but the documented live-trading and bot-generation flow does not describe an enforced technical confirmation control. In a trading context, missing hard confirmation gates can lead to unintended order placement, causing direct financial loss if the generated or integrated bot is run as-is.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The skill asset is explicitly scoped as NUANCES_en.md, and all instructional content is presented only in English. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy violation unless the restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.