Security audit

Trade Signal

Security checks across malware telemetry and agentic risk

Overview

This finance skill is purpose-aligned, but its helper script handles user queries unsafely and can run local code from a crafted query.

Review before installing. Do not run this skill on untrusted or copied query text until the script is fixed to pass the query as data, for example via sys.argv or curl --data-urlencode. Avoid sending confidential portfolio, account, or strategy details to the third-party API, and treat any trading output as research support rather than personalized investment advice.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises and demonstrates shell-script execution and remote API access, but declares no permissions or trust boundaries. This weakens agent-side governance because an orchestrator may invoke networked or shell-capable behavior without explicit user/admin approval, increasing the risk of unintended external data exfiltration, command execution, or policy bypass.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill claims to provide narrowly scoped trade signals, but the documented interface accepts arbitrary natural-language queries and forwards them to an external API. That mismatch is dangerous because broad query forwarding can be repurposed for unrelated data retrieval or prompt-routing behaviors outside the declared security and review scope, undermining user expectations and policy enforcement.

Vague Triggers

High

Confidence: 90% confidence
Finding: The activation text is extremely broad, covering many common finance and investment conversations, which can cause the skill to trigger in contexts where the user did not explicitly request an external trading-signal tool. In a finance domain, overbroad auto-invocation is especially risky because it can insert high-impact buy/sell recommendations into ordinary discussion and route sensitive user queries to a third-party service unnecessarily.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The example auto-use prompts expand invocation boundaries without clear limits, encouraging ambiguous triggering on generic questions like company outlook or analyst sentiment. This increases the chance of unintended third-party requests and unreviewed reliance on actionable financial output where a simple conversational answer may have been sufficient.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill provides executable trading recommendations, entry/exit points, and options strategies but does not present any user-facing risk warning, suitability caveat, or reminder that outputs may be incorrect or not personalized. In this context, omission of safety framing is dangerous because users may over-trust the output and take immediate financial actions with material loss potential.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script transmits the full user-supplied query to an external service without any disclosure, consent, or indication that potentially sensitive prompts will leave the local environment. In a trading skill, users may include portfolio holdings, strategy details, account-related context, or material nonpublic business information, so this creates a real privacy and data-handling risk even though the request is sent over HTTPS.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.