Kraken Pro

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:20 PM UTC
• Version: 1.0.6

Overview

This Kraken skill is not malicious, but it needs Review because it combines live exchange credentials with trading, staking, withdrawals, and raw financial data exports under broad routing.

Install only if you are comfortable giving this skill access to your Kraken account through API keys. Prefer a read-only Kraken key for portfolio, balances, orders, trades, and ledger exports; use a separate transaction-capable key only when you intentionally need trading, staking, or withdrawals, and keep withdrawal permission disabled unless required. Treat --json and --csv output as sensitive financial records that may be logged by the agent environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Third-Party Financial SDK Installed Without Artifact Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1; installation instruction at SKILL.md:12-15
Vulnerability Type: Supply-chain integrity weakness
Risk Level: Medium

Vulnerable Code

requirements.txt:1:

text

python-kraken-sdk==3.2.7

SKILL.md:12-15:

bash

## Setup

pip3 install -r requirements.txt

Technical Analysis

The project pins python-kraken-sdk to a specific version, which reduces unintended version drift, but it does not pin the package artifact with a cryptographic hash. The documented installation command also does not use pip's --require-hashes option.

Consequently, installation trusts the package artifact returned by the configured Python package index. The CLI imports this dependency and passes Kraken API credentials to SDK objects in kraken_cli.py:25-32. It also uses the SDK for sensitive account operations, including trading, staking allocation, and withdrawals.

This does not establish that the pinned dependency is malicious. The weakness is the absence of artifact-level integrity verification for a dependency operating within a financially sensitive trust boundary.

Attack Path

1. An attacker compromises the relevant package distribution channel, configured package index, or the artifact associated with the pinned release.
2. A user follows the setup instruction in SKILL.md and runs pip3 install -r requirements.txt.
3. Pip installs the substituted artifact because no expected SHA-256 hash is specified or enforced.
4. Malicious package code can execute during installation or when kraken_cli.py imports the SDK.
5. At runtime, the CLI supplies KRAKEN_API_KEY and KRAKEN_API_SECRET to SDK clients.
6. The malicious dependency can read process credentials, alter Kraken API operations, or perform other actions available to the local process and API key.

Impact Assessment

Successful exploitation could permit arbitrary code ...[truncated 576 chars]

Remediation

View remediation

Remediation Suggestions

1. Generate a reviewed lock file containing SHA-256 hashes for every direct and transitive dependency.

2. Enforce hash validation during installation:

   bash

   pip install --require-hashes -r requirements.txt
   

3. Obtain packages only from an explicitly configured, trusted index or an internally controlled artifact repository.

4. Review and verify the selected python-kraken-sdk release before approving its hashes.

5. Perform dependency vulnerability and provenance checks in CI, and require review for lock-file updates.

6. Install and run the Skill in an isolated virtual environment or container under a non-privileged operating-system account.

7. Use least-privilege Kraken API keys. Keep withdrawal permission disabled unless the withdrawal feature is explicitly required, and use separate credentials for read-only and transaction-capable workflows where practical.

8. Rotate Kraken credentials immediately if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill exposes sensitive capabilities via environment variables and network/API access, but it does not declare an explicit tool scope such as permissions or allowed-tools. In a financial trading skill, this ambiguity is dangerous because an orchestrator may invoke the skill more broadly than intended, enabling account queries, order placement, staking changes, or withdrawals with live Kraken credentials.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description says to use the skill when the user wants to interact with Kraken 'in any way,' which is an overly broad activation scope for a skill that can access account balances, trade, stake, and withdraw funds. Overbroad routing increases the chance the agent will select this skill for loosely related prompts, unnecessarily exposing high-value credentials and enabling sensitive financial actions in contexts where a narrower skill should have been used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The CLI supports emitting highly sensitive Kraken account data such as balances, trade history, ledger entries, deposit addresses, and withdrawal status directly to stdout in raw JSON or CSV. In an agent/skill context, stdout is often captured, logged, persisted, or relayed to other components, so this can unintentionally expose financial and transactional data far beyond the immediate user session.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.