T08 · Insecure Dependencies
Warning
- Location
SKILL.md:5- Finding
Unpinned Node.js Dependencies Create a Supply-Chain Exposure
- Content
View full analysis
- Remediation
View remediation
Security audit
Crypto Strategy Suite
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed crypto trading skill, but it can start automated spot and futures trading with exchange keys without enough live-trading guardrails.
Review this before installing. Use testnet or paper trading first, create exchange API keys limited to the needed pair and trading permissions, disable withdrawals, avoid the 'all enabled' option until limits are understood, and confirm SkillPay charging terms before invocation.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The quick-start flow encourages users to select and launch strategies, including futures strategies, but does not clearly warn that this can trigger real exchange orders and begin live automated trading. In a trading context, missing or weak disclosure is particularly dangerous because a user may unintentionally authorize market activity that can rapidly cause direct financial loss, especially with leveraged products.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is presented as a BTC/USDT trading strategy suite, but the embedded code also performs external billing, balance checks, and payment-link generation through a third-party service. This is a risky capability mismatch: users may invoke a trading skill without expecting off-platform financial charges or blockchain payment flows, increasing the chance of hidden monetization, consent failures, or abuse if identifiers or API keys are mishandled.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation includes account-balance checks, charging, and blockchain payment-link generation that are not essential to the core function of executing trading strategies. Even if intended for monetization, these capabilities expand the attack surface by handling financial state and external payment flows, which can expose users to unauthorized charges, privacy leakage, or phishing-style redirection if the payment flow is altered.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill name/description and nearly all user-facing instructions are presented in Chinese, and the document does not indicate that the language is optional or region-specific. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content