Security audit

Rally

Security checks for vulnerabilities and agentic risk

Overview

Rally matches its portfolio-research purpose, but it automatically installs scheduled jobs including a silent daily self-update that can replace reviewed skill files from GitHub.

Install only if you are comfortable with Rally creating scheduled jobs and updating itself from GitHub without reviewing each change. Before use, review or disable the rally:update cron job, confirm the daily cron behavior, keep trade execution disabled unless intentionally configured, and protect the local Rally data and journal directories as financial records.

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: A daily self-update from GitHub introduces a remote code supply-chain path that can change the skill after installation without a fresh review by the user. If the upstream repository is compromised, the owner account is hijacked, or a bad update is published, the scheduled updater could pull and deploy malicious code automatically.

Missing User Warnings

High

Confidence: 98% confidence
Finding: A daily self-update from GitHub introduces a remote code supply-chain path that can change the skill after installation without a fresh review by the user. If the upstream repository is compromised, the owner account is hijacked, or a bad update is published, the scheduled updater could pull and deploy malicious code automatically.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The scheduled tasks section documents cron-based automation but does not clearly warn that jobs will be installed and execute automatically on the host. Silent persistence via cron is security-relevant because it creates recurring background execution that may continue beyond the user's awareness and can later trigger network access, updates, or other side effects.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs automatic cron registration during initialization, creating recurring background actions without a strong explicit consent or warning flow. Even though the scheduled jobs appear operationally relevant, silently establishing persistence can surprise users, cause unintended repeated network/data activity, and normalize unattended behavior in an agent context.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The self-update flow downloads code from a remote repository tarball and overwrites local files in place, with no signature verification, pinning, integrity check, review gate, or rollback. Because it runs silently unless the version changes or errors, a compromised upstream repo, GitHub account, or network/API path could push unreviewed code into the local environment.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The skill mandates writing persistent journal files to a fixed path under the user's home directory, but it does not instruct the user that execution will create retained on-disk artifacts. This can expose prompts, commands, run identifiers, timestamps, and reasoning summaries to unintended local disclosure or compliance/privacy issues, especially on shared systems or when journals contain sensitive operational context.

Self-Modification

High

Category: Rogue Agent
Content: ``` ## Self-update `rally.update` pulls the latest package from the `source:` URL in this file's frontmatter. Runs silently — no output unless the version changed or an error occurred.
Confidence: 98% confidence
Finding: This is a direct self-modification capability: the skill can replace its own local contents from a remote source. In an agent system, self-modifying behavior materially increases risk because future executions may no longer match the reviewed version, undermining trust, auditability, and containment.

Static analysis

No suspicious patterns detected.