Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Upbit trading bot, but it needs review because it can run unattended real trades and may manage existing account holdings while some safety documentation and sizing controls are inconsistent.
Review before installing. Use dry-run first, restrict Upbit API key permissions and funds, verify whether the bot should be allowed to sell holdings already in the account, and do not rely on the documented percent-based budget split until the implementation is fixed or confirmed. Pin dependencies and use a lockfile before live deployment.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# secrets
config.json
.env
# node
node_modules
The code chunk’s primary purpose is indicator calculation, not automated trading. While indicators like RSI, MACD, Bollinger Bands, and ATR could support a trading bot, this snippet only provides analytical helpers and a test CLI. It lacks any exchange access, trading workflow, market scanning, volume ranking, portfolio allocation, or breakout-specific execution logic described in the declaration. Therefore, the description materially overstates and misrepresents what this code actually does.
The declared description is about automated Upbit trading features, but the supplied code does not implement trading, market monitoring, cron-run execution, or budget splitting. Instead, it performs a static local security scan over project files to detect unexpected remote endpoints and verify an allowlisted Upbit host. This is a materially different primary purpose and introduces undeclared filesystem access and auditing behavior unrelated to the stated trading functionality.
The declared description presents a full automated Upbit trading skill with operational features like run-once commands, TopVolume monitoring, and budget allocation logic. The supplied code chunk does not implement those capabilities. It only contains a standalone strategy function that computes a breakout target and basic signal from candle inputs. While this is loosely related to breakout trading, it is materially narrower than the declared purpose and lacks the exchange-specific, automation, monitoring, and budgeting functionality described.
The declared description presents an automated Upbit trading skill with specific trading strategy and monitoring capabilities. The supplied code chunk instead is a standalone test script for inserting or updating mock position records in a local positions.json file. Its primary purpose is test data setup for sell tests, not executing or supporting the described trading strategy in any visible way. This is a material mismatch in purpose and behavior.
Referenced artifact was not completely inspected
- `scripts/execution/upbitClient.js` (Upbit HTTP client)
The README documents two different environment variable name pairs for the same Upbit credentials: UPBIT_OPEN_API_ACCESS_KEY/UPBIT_OPEN_API_SECRET_KEY in the security section and UPBIT_ACCESS_KEY/UPBIT_SECRET_KEY in the configuration section. In a trading bot that handles live exchange keys, this inconsistency can cause operators to believe secrets are being injected securely when the application may not read them, leading them to fall back to storing credentials in config.json or running with misconfigured authentication.
The manifest declares required environment-variable access but does not expose a clear tool scope such as permissions or allowed-tools. In a skill that handles exchange API credentials and can place trades, unclear capability scoping increases the chance that the platform or user grants broader access than intended and makes review harder.
The manifest requires UPBIT_ACCESS_KEY and UPBIT_SECRET_KEY, but the security guidance tells users to provide UPBIT_OPEN_API_ACCESS_KEY and UPBIT_OPEN_API_SECRET_KEY. This mismatch can cause failed authentication, unsafe debugging, or users placing secrets into config files or other less secure locations when the documented method does not work.
The command documentation for worker_once says it processes BUY/SELL events and updates positions, but does not prominently warn that it may place real trades unless dry-run is enabled. In a trading skill, insufficient warning materially increases the risk of accidental financial loss from operator misuse.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
* 업비트 공용 시세 조회 모듈 (market.js)
*/
const BASE_URL = 'https://api.upbit.com/v1';
/**
* 마켓 코드 조회 (전체 종목 리스트)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
* 업비트 공용 시세 조회 모듈 (market.js)
*/
const BASE_URL = 'https://api.upbit.com/v1';
/**
* 마켓 코드 조회 (전체 종목 리스트)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
* 업비트 공용 시세 조회 모듈 (market.js)
*/
const BASE_URL = 'https://api.upbit.com/v1';
/**
* 마켓 코드 조회 (전체 종목 리스트)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
* 업비트 공용 시세 조회 모듈 (market.js)
*/
const BASE_URL = 'https://api.upbit.com/v1';
/**
* 마켓 코드 조회 (전체 종목 리스트)
The cancelOrder method issues a DELETE request to cancel an order, which is an irreversible or safety-critical trading action. Unlike the buy/sell methods, it has no logging, confirmation prompt, or inline warning comment indicating that cancellation will be performed.
This file includes natural-language descriptions and runtime log messages in Korean, such as the header comments and multiple operator-facing status strings. Because the skill does not offer a language or locale choice, it effectively forces a specific language, which matches the policy-violation criteria for locale/language restrictions.
The help output says "config.json required (do not commit)", while the file header at L013-L014 states config.json is optional and non-secret defaults can come from config.example.json. This contradiction can mislead operators about the skill's intended configuration model.
The cron setup examples require --tz "Asia/Seoul", which imposes a specific locale setting in the skill instructions. The README does not present this as an optional example or offer users a choice of timezone, so it can conflict with organizational language/locale policies.
The manifest uses a caret range for axios instead of pinning an exact version, which allows different installations to resolve to different patch/minor releases. In a trading automation skill that handles network requests and likely processes sensitive exchange/API interactions, this weakens supply-chain reproducibility and makes it harder to guarantee that a known-safe version is installed.
"license": "ISC",
"type": "commonjs",
"dependencies": {
"axios": "^1.13.5",
"jsonwebtoken": "^9.0.3",
"uuid": "^13.0.0"
},
axios has multiple known advisories, and because the manifest does not pin an exact version, it is not possible to verify from this file whether the installed release is affected. In a trading bot, an HTTP client issue can be more consequential because it may interact with market data, orders, credentials, or internal network paths.
jsonwebtoken is declared with a caret range, so consumers may install different releases over time. Because JWT libraries are security-sensitive and this skill likely uses exchange authentication, non-deterministic dependency resolution can expose the skill to vulnerable or behavior-changing versions without code changes.
"type": "commonjs",
"dependencies": {
"axios": "^1.13.5",
"jsonwebtoken": "^9.0.3",
"uuid": "^13.0.0"
},
"bin": {
jsonwebtoken has a history of security advisories, and the unpinned declaration prevents verifying whether a safe release is actually installed. In the context of an automated trading skill, flaws in JWT handling can directly affect authentication integrity, potentially enabling token misuse, verification bypass, or unauthorized API access.
uuid is also specified with a caret range, permitting version drift across environments. While lower risk than an auth or HTTP client package, unpinned dependencies still increase supply-chain uncertainty and can pull in flawed releases unexpectedly.
"dependencies": {
"axios": "^1.13.5",
"jsonwebtoken": "^9.0.3",
"uuid": "^13.0.0"
},
"bin": {
"trading-upbit-skill": "skill.js"
uuid has at least one known advisory, and the absence of an exact pinned version means the installed package cannot be validated from this manifest alone. The direct security impact is likely lower than for auth/network libraries, but it still represents unverifiable supply-chain risk.
The file's natural-language comments are written exclusively in Korean, which imposes a specific language choice without any indication that the skill is region-specific or that users can opt into that locale. Under the policy rule for language/locale constraints, this is a natural-language policy concern rather than a code-security issue.
Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal