Security audit

Trade Singal

Security checks across malware telemetry and agentic risk

Overview

This finance skill has a coherent API purpose, but its query script can run unintended local code from a crafted query and it under-discloses broad external sharing of sensitive finance prompts.

Review carefully before installing. Do not run this skill on untrusted or attacker-controlled query text until the URL encoding is fixed to pass the query as data, and avoid sending private holdings, brokerage details, or planned trades unless you are comfortable sharing them with terminal-x.ai.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents shell-based execution (`./scripts/search.sh`) and outbound API use but declares no permissions or user-facing constraints. This creates an undeclared capability gap: agents or users may invoke network and shell operations without an explicit trust boundary, making data exfiltration, unexpected command execution, or policy bypass harder to detect and govern.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill is marketed as a trade-signal engine with executable Buy/Sell/Hold recommendations, but the visible behavior is largely generic query forwarding to an external API with no local validation, signal-generation logic, or scope enforcement. This mismatch is dangerous because an agent may grant the skill elevated trust or invoke it for sensitive investment decisions while the actual behavior is opaque and externally controlled.

Description-Behavior Mismatch

Medium

Confidence: 82% confidence
Finding: The documentation claims actionable trade signaling, yet most examples are ordinary financial research and summarization queries. This can mislead users and orchestrating agents into treating general research output as vetted trading advice, increasing the risk of unsafe autonomous actions or misplaced reliance on unverified recommendations.

Intent-Code Divergence

Medium

Confidence: 80% confidence
Finding: The quick-start and flow examples are labeled as trade-signal usage but actually demonstrate plain research lookups. This inconsistency can cause downstream systems to auto-route broad financial prompts into a skill assumed to provide actionable recommendations, even when the examples show no such controlled behavior.

Vague Triggers

High

Confidence: 90% confidence
Finding: The activation description is extremely broad, covering nearly any investment, stock-analysis, or portfolio question. Overbroad triggers are risky because they can cause automatic invocation on routine finance conversations, unnecessarily sending user queries to an external service and expanding the chance of privacy leakage, unwanted tool use, or overreliance on opaque outputs.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The auto-invocation guidance lists broad sample prompts but provides no boundaries on when not to activate. In context, this makes the skill more dangerous because finance questions often contain sensitive portfolio details or require nuanced judgment, yet the documentation encourages eager routing to an external API without a gating step.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill does not clearly warn users that their prompts are sent to an external API service. In a finance context, users may include highly sensitive investment intentions, holdings, or trading strategies; undisclosed transmission of that data to a third party creates privacy, compliance, and trust risks.

Missing User Warnings

Low

Confidence: 93% confidence
Finding: The script transmits the raw user-supplied query to an external service over the network without any user-facing notice, consent step, or data-sensitivity check. In a trading skill, queries may contain portfolio details, watchlists, intended trades, or other sensitive financial context, so silent exfiltration to a third-party endpoint creates a real privacy and confidentiality risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.