T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:25- Finding
Trade-Authorizing Bearer Credential Can Be Redirected to an Arbitrary Server
- Content
View full analysis
- Remediation
View remediation
Security audit
Xxyy Trade
Security checks for vulnerabilities and agentic risk
Overview
This crypto trading skill is coherent, but it needs review because it uses a wallet-authorizing API key with broad activation, automatic wallet discovery, and a configurable API destination.
Install only if you intend to let this skill use an XXYY API key that can spend wallet funds. Keep XXYY_API_BASE_URL unset unless you fully trust and control the destination, use XXYY IP allowlisting, rotate the key if it may have been sent to the wrong host, and manually verify wallet, chain, amount, fees, and launch parameters before any transaction.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:1027- Finding
Automatic Cross-Chain Wallet Enumeration Exceeds Activation-Time Least Privilege
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:846- Finding
Token Launch Operations Lack a Dedicated Explicit Confirmation Gate
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises very broad trigger phrases such as "feed," "onboarding," and "get started," which can cause the trading skill to activate in conversations that are not actually requesting crypto operations. In this context, unintended activation is risky because the skill has access to a custodial trading API key and can query wallets, balances, IP information, and potentially prepare trade flows.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
Remembering and reusing a default wallet for subsequent trades "without asking again" increases the chance of acting on the wrong wallet through stale session state or ambiguous user intent. In a custodial trading context, that can lead to unintended trades from a different account balance than the user expected.
- Content
md 2. **Display format** -- Show wallet name, address, native balance. Mark pinned wallets with ⭐. 3. **Token holdings** -- If user asks about specific token holdings, pass `tokenAddress` to show per-wallet balance. 4. **No wallets** -- If response returns empty list, guide user to create at: https://www.xxyy.io/wallet/manager?chainId={chain} 5. **Default wallet memory** -- After user selects a wallet, remember it as the default for that chain in the current session. Use this default for subsequent trades on the same chain without asking again. 6. **Single wallet query** -- When the user provides a specific wallet address and asks for its balance, use Wallet Info API instead of List Wallets. Also use Wallet Info to show balance before trade confirmation. 7. **Error handling** -- Same as other data query APIs (see Error Codes table).
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Automatically executing onboarding on skill activation is a form of autonomous action that triggers network access and account discovery before the user has explicitly asked for setup or wallet inspection. Given this skill's access to a unified read/write trading API key, even seemingly read-only autonomous behavior meaningfully increases privacy and misuse risk.
- Content
md ## Onboarding Flow **Trigger**: Automatically execute once when the skill is first activated in a session. Run only once per session. ### Detection Logic
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The onboarding flow is configured to run automatically on first activation and, in the API-key-present case, silently pings the service and fetches wallets across four chains. Because activation itself is broadly scoped elsewhere in the skill, this can cause unsolicited external requests and exposure of wallet metadata in response to unrelated user prompts.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
| 8062 | Rate limited | All APIs — data query: retry after 2s; trade: retry after 1s (except swap, see Execution Rules #5) | | 8063 | IP not in whitelist — use
get_ipto check current IP, update whitelist at https://www.xxyy.io/apikey | All APIs |Example curl
bash # Buy
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list is extremely broad and includes generic phrases like "feed," "monitor chain," "get started," and wallet-related commands. In a skill that can execute real trades with a custodial API key, broad activation increases the chance the skill is invoked for ambiguous requests and steers the session into high-risk financial actions or wallet/API-key workflows the user did not intend.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
Remembering and reusing a default wallet "without asking again" reduces friction but weakens transactional intent verification in a financial skill. If the skill is triggered ambiguously or conversation context is manipulated, subsequent trades may be prepared against a previously selected wallet the user did not mean to use in the current request.
- Content
md 2. **Display format** -- Show wallet name, address, native balance. Mark pinned wallets with ⭐. 3. **Token holdings** -- If user asks about specific token holdings, pass `tokenAddress` to show per-wallet balance. 4. **No wallets** -- If response returns empty list, guide user to create at: https://www.xxyy.io/wallet/manager?chainId={chain} 5. **Default wallet memory** -- After user selects a wallet, remember it as the default for that chain in the current session. Use this default for subsequent trades on the same chain without asking again. 6. **Single wallet query** -- When the user provides a specific wallet address and asks for its balance, use Wallet Info API instead of List Wallets. Also use Wallet Info to show balance before trade confirmation. 7. **Error handling** -- Same as other data query APIs (see Error Codes table).
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 86% confidence
- Finding
Automatically executing onboarding on first activation causes the skill to initiate authenticated API activity and enumerate wallets even before the user explicitly asks for those actions. In this context, silent pinging and wallet discovery increase data exposure and can normalize background operations in a skill tied to custodial trading authority.
- Content
md ## Onboarding Flow **Trigger**: Automatically execute once when the skill is first activated in a session. Run only once per session. ### Detection Logic
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
The skill is explicitly designed to send authenticated curl requests containing a bearer API key to an external service that can query wallets, reveal server egress IP, and execute real trades or token launches. External transmission is expected here, but it is still security-sensitive because the same key grants spending authority and there is no read-only mode, so any misuse, logging, or prompt-induced action can have direct financial consequences.
- Content
| 8062 | Rate limited | All APIs — data query: retry after 2s; trade: retry after 1s (except swap, see Execution Rules #5) | | 8063 | IP not in whitelist — use
get_ipto check current IP, update whitelist at https://www.xxyy.io/apikey | All APIs |Example curl
bash # Buy
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The instructions prescribe user commands in Chinese such as "修改默认钱包 {chain} {wallet name or address}" as part of the interaction flow, but do not state that language is optional or user-selectable. This can create a locale policy issue by implicitly privileging one language in command examples without an explicit opt-in or alternative guidance.
- Content