MemoTrader

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:53 PM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned, but it asks the agent to store a live MemoTrader API key in plaintext memory and can make account changes.

Before installing, treat the MemoTrader PA key like a password. Prefer a dedicated secret store or environment variable instead of memory/memotrader.md, revoke any key previously stored in plaintext, and require confirmation before dismissing messages or changing profile and clique settings.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:12

Finding

Privileged PA API Key Stored in Persistent Plaintext Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 12
Vulnerability Type: Persistent plaintext credential storage
Risk Level: Medium

Vulnerable code snippet:

markdown

The human must generate a `pa_` key at https://memotrader.com/account/assistant/ and provide it to you. Store it in `memory/memotrader.md`.

Technical Analysis

The skill explicitly instructs the agent to persist a privileged MemoTrader Personal Assistant API key in memory/memotrader.md. No encryption, secret-manager integration, file-permission requirements, redaction controls, or credential-lifetime restrictions are specified.

Agent memory is generally intended for persistent contextual state rather than secret storage. Depending on the host environment, the memory file could be exposed through local file access, backups, diagnostic bundles, workspace synchronization, source-control mistakes, or unrelated tools and skills that can read the same workspace.

The API documentation establishes that the key authorizes access to private account data and state-changing operations. An exposed key could be used to:

• Read inbox messages, individual messages, conversations, profile details, balance, and pricing information.
• Dismiss messages from the inbox.
• Modify public profile fields.
• Join or leave public cliques.
• Access other read-only agent endpoints accepted by PA keys.

The documentation states that the PA cannot reply to messages, spend credits, accept bids, post campaigns, or reset the notice price. Therefore, the impact is substantial account-data disclosure and limited account modification rather than full control over all MemoTrader functionality.

Attack Path

1. The user provides a valid pa_ API key while configuring the skill.
2. Following the skill instructions, the agent writes the credential to memory/memotrader.md.
3. An attacker gains read access to that file through another local process, an ...[truncated 1126 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to save the API key in memory/memotrader.md.
2. Store the key in an operating-system credential vault, encrypted secret manager, or the agent platform's dedicated secret-storage facility.
3. Inject the credential only when an API request is made, and avoid placing it in prompts, persistent memory, command history, logs, or diagnostic output.
4. Store only non-sensitive operational state in memory/memotrader.md, such as lastInboxCheck and knownMessageIds.
5. If file-based storage is unavoidable, encrypt the credential at rest with a key maintained outside the project and restrict file permissions to the owning account.
6. Add explicit instructions to redact the X-API-Key header from logs, exceptions, transcripts, and debugging output.
7. Support key rotation and immediate revocation, and advise users to revoke any key previously stored in plaintext.
8. Apply the narrowest API scope available and use short-lived credentials if MemoTrader introduces scoped or expiring PA keys.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to store a live pa_ API key in memory/memotrader.md, which creates unnecessary persistence of a sensitive credential in general agent memory. If memory is exposed to other skills, logs, backups, or prompt injection elsewhere in the system, the key could be exfiltrated and used to access the human's MemoTrader assistant data without their consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file documents authentication via an X-API-Key header and later shows a PowerShell example storing a pa_ key directly in a variable. The file does not include any warning about protecting the key, avoiding hardcoding, or treating it as a sensitive credential, even though compromise would grant API access to personal assistant data and actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.