T03 · Remote Payload Retrieval and Execution
Error
- Location
references/mcp.md:22- Finding
Remote installer output is executed directly by system shells
- Content
View full analysis
- Remediation
View remediation
Security audit
Tigerbrokers
Security checks for vulnerabilities and agentic risk
Overview
This is a legitimate Tiger Brokers API skill, but it warrants Review because it handles brokerage credentials and live financial actions while including unsafe setup, broad activation, and confirmation-bypass examples.
Install only after review. Use paper trading and MCP read-only mode by default, require explicit human confirmation before any live order, order change, cancellation, fund transfer, or forex conversion, avoid -y in agent workflows, pin and review package versions, do not run curl-to-shell installer commands, never disable TLS verification for real API use, and keep Tiger private keys/tokens out of project or synced editor config files.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T08 · Insecure Dependencies
Error
- Location
references/mcp.md:13- Finding
Unpinned packages are executed with access to brokerage credentials and trading tools
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/quickstart.md:438- Finding
Troubleshooting guidance globally disables HTTPS certificate verification
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/mcp.md:40- Finding
Long-lived brokerage secrets are embedded in environment variables and persistent editor configuration
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (28)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
Piping network content directly into
shis a dangerous shell-chaining pattern because any compromise of the hosting site, transport path, or referenced script results in immediate arbitrary command execution. Given this skill configures an MCP server for trading-related API access, successful exploitation could also expose credentials and enable downstream account abuse.- Content
bash # macOS/Linux curl -LsSf https://astral.sh/uv/install.sh | sh # Windows PowerShell powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The institutional example includes
TIGEROPEN_SECRET_KEYandTIGERMCP_TOKENalongside the private key without a strong warning about handling highly sensitive authentication material. Because this MCP server can expose trading operations to AI editors, compromise of these secrets could lead to unauthorized API access, account misuse, or potentially fraudulent trading actions.- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md | 编辑器 Editor | 配置路径 Config Path | |--------------|---------------------| | Cursor | `.cursor/mcp.json` (项目级) 或 `~/.cursor/mcp.json` (全局) | | Claude Code | `.claude/settings.local.json` 或 `~/.claude/settings.json` | | Trae | `.trae/mcp.json` | | Kiro | `.kiro/settings/mcp.json` (项目级) 或 `~/.kiro/settings/mcp.json` (全局) |
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 95% confidence
- Finding
The hidden HTML comment contains behavioral instructions for when the skill should activate around buying, selling, and order placement. Hidden instructions are risky because they influence agent behavior outside normal user-visible content, and in a trading skill they can silently steer the agent toward initiating financial transactions.
- Content
md --- ## 下单 / Place Orders <!-- 当用户提到 "买入"、"卖出"、"下单"、"buy"、"sell"、"order"、"place order" 时 --> ### 限价单 LMT / Limit Order
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
The hidden comment before the modify-order section instructs activation on generic modification requests. Because it is concealed from normal readers, it can bias agent behavior toward editing live orders without transparent review, which is especially sensitive in a brokerage context.
- Content
text ## 修改订单 / Modify Order <!-- 当用户提到 "改单"、"修改订单"、"modify"、"change order" 时 --> ```python order = trade_client.get_order(id=123456789)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 88% confidence
- Finding
The hidden comment in the order-query section invisibly instructs activation for generic order-related terms. Even though querying is less severe than execution, hidden routing rules undermine transparency and can trigger retrieval of sensitive brokerage information without clearly bounded user intent.
- Content
查询订单 / Query Orders
python # 所有订单 / All orders
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The auto-activation list is extremely broad and includes generic terms like price, account, order, buy, sell, trade, and quote that are common in ordinary financial discussion. This can cause the trading skill to trigger in contexts where the user did not intend brokerage/API assistance, increasing the chance of inappropriate tool exposure, unsafe trade-oriented suggestions, or accidental handling of sensitive account-related workflows.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 91% confidence
- Finding
This documentation explicitly shows how to place a live trade while bypassing the default confirmation prompt using
-y. In an AI-agent skill context, that materially lowers the safety barrier for autonomous execution, since an agent could submit real orders without a final human check. Because this skill is specifically for trading operations against a brokerage API, the context makes the issue more dangerous than generic CLI automation guidance.- Content
下单（默认需要确认）/ Place order (confirmation required by default)
tigeropen trade order place --symbol AAPL --action BUY --quantity 100 --limit-price 150
跳过确认 / Skip confirmation
tigeropen trade order place --symbol AAPL --action BUY --quantity 100 --limit-price 150 -y
text
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 87% confidence
- Finding
The example shows modifying an existing live order while skipping confirmation with
-y, enabling an agent to alter price or quantity without interactive review. Although modification is narrower than initial order placement, it can still materially change execution risk, cost, and market exposure. In a trading skill, this is meaningfully dangerous because order changes can have immediate financial consequences.- Content
修改辅助价 / Modify aux price
tigeropen trade order modify 12345678 --aux-price 140
跳过确认 / Skip confirmation
tigeropen trade order modify 12345678 --limit-price 155 -y
text
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The documentation shows canceling orders with
-y, which removes the human confirmation checkpoint for a sensitive account action. While canceling an order is often protective rather than harmful, an autonomous or compromised agent could still disrupt intended trading activity, interfere with strategy execution, or cause financial loss through mistimed cancellations. The trading context increases the significance of this autonomy-enabling pattern.- Content
撤销订单（需确认）/ Cancel order (confirmation required)
tigeropen trade order cancel 12345678
跳过确认 / Skip confirmation
tigeropen trade order cancel 12345678 -y
text
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 65% confidence
- Finding
uvx/uv tool run commands without ==version create a rug-pull risk.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 65% confidence
- Finding
uvx/uv tool run commands without ==version create a rug-pull risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill instructs users to place account identifiers and especially
TIGEROPEN_PRIVATE_KEYinto environment variables, but it does not clearly warn that these values are highly sensitive and may be exposed through shell history, process inspection, crash logs, screenshots, editor integrations, or misconfigured MCP environments. In the context of a trading MCP server, secret exposure is more dangerous because leaked credentials could enable unauthorized account access or transaction capability.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file includes multiple code examples that directly call
trade_client.place_order(order)for live option and combo trades, but it does not place a clear, prominent warning immediately around those examples that they can execute real transactions against a funded brokerage account. In a trading skill, this is especially risky because users may copy-paste examples into a configured environment and unintentionally submit market-impacting orders, creating immediate financial loss or unwanted positions.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The document instructs users to connect with
client_config.tiger_idandclient_config.private_key, and earlier references loading config from a local path. Although this is part of the skill's purpose, the markdown does not include an explicit warning that the private key is sensitive credential material and should not be exposed in logs, shared configs, or source control.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file demonstrates subscribing to order, position, asset, and transaction push events, which expose sensitive account and portfolio information. While the examples explain how to enable these feeds, they do not warn that these callbacks surface private financial data and should be handled, logged, and shared carefully.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation shows private keys and other secrets in properties files, environment variables, and inline code examples without strong warnings about leakage through source control, shell history, logs, screenshots, or shared development environments. In a trading context, exposed credentials could enable unauthorized access to market data or trading APIs, making the omission more dangerous than in a non-financial SDK.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The SSL troubleshooting snippet globally disables HTTPS certificate verification by assigning
ssl._create_default_https_context = ssl._create_unverified_context. In a trading SDK skill, this can expose API credentials, account data, and trading actions to man-in-the-middle attacks if users copy the snippet into real code, even though it is labeled 'debug only'.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill embeds broad trigger phrases like 'buy', 'sell', 'order', and 'place order' in hidden comments to drive invocation of order-placement behavior. In a trading skill, over-broad activation increases the chance that routine discussion is interpreted as intent to place trades, which could lead to unintended high-risk financial actions.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 93% confidence
- Finding
The CLI documentation includes a '-y' option to skip confirmation for order cancellation. In an agent-executable context, suppressing confirmation reduces friction around state-changing financial actions and can enable accidental or automated cancellation of live orders without a user checkpoint.
- Content
bash # CLI tigeropen trade order cancel ORDER_ID tigeropen trade order cancel ORDER_ID -y # 跳过确认 / skip confirmation撤销为异步操作。使用
id(全局订单ID)。Cancellation is async. Use global orderid.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The hidden trigger comment for order queries uses generic terms like 'orders' and 'order list', which may activate this skill in contexts that are merely informational. While querying orders is less dangerous than placing them, it can still expose sensitive account activity or cause the agent to enter a trading workflow unexpectedly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The fund transfer section documents moving money between trading segments without an explicit warning that this affects real funds and may alter margin availability and liquidation risk. In a live brokerage skill, omission of a strong warning and confirmation flow materially increases the risk of accidental movement of real capital.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The forex order example omits an explicit warning that currency conversion is a real executable financial transaction with potential fees, slippage, and account-balance effects. In a brokerage skill, presenting conversion as a simple utility call can cause users or agents to treat it as harmless data manipulation rather than a live order.
- Content
Rp1
Low
- Category
- MCP Rug Pull
- Confidence
- 60% confidence
- Finding
pip install without ==version installs the latest release, which could include malicious changes.
- Content
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The instruction
curl -LsSf https://astral.sh/uv/install.sh | shdownloads and executes a remote script in one step, preventing meaningful inspection before execution and creating a classic supply-chain/code-execution risk. In a developer-tooling skill, this is more dangerous because users are likely to run the command on workstations that also hold source code, tokens, and trading credentials.- Content
bash # macOS/Linux curl -LsSf https://astral.sh/uv/install.sh | sh # Windows PowerShell powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
Static analysis
No suspicious patterns detected.