Crypto Algo Execution

• Outcome: Review
• Latest audit: May 28, 2026 · 9:56 AM UTC
• Version: 1.0.3

Overview

The skill matches its crypto-trading purpose, but it needs review because an optional notification script can send order details to arbitrary webhooks or run a configured local command while live trading credentials may be present.

Review before installing. Use restricted QE and exchange API keys, disable withdrawals, apply IP allowlists where possible, and confirm every create/update/cancel parameter before execution. Avoid the command notification channel unless you fully control the environment and executable path, and only use webhook notifications to trusted destinations because they can receive order details.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

notify_cmd = os.environ.get("NOTIFY_COMMAND")
    if not notify_cmd:
        raise ValueError("NOTIFY_COMMAND not set for command channel")
    proc = subprocess.run([notify_cmd, target, message], capture_output=True, text=True)
    if proc.returncode != 0:
        err = (proc.stderr or proc.stdout or "").strip()
        raise RuntimeError(f"command notify failed: {err}")

• Confidence: 96% confidence
• Finding: The command channel executes whatever binary path is provided in the NOTIFY_COMMAND environment variable, passing attacker-controllable target and message data. Even without shell=True, this is still arbitrary program execution if an attacker can influence environment configuration, which is especially risky in automation or agent environments where secrets and exchange credentials may be present.

Tainted flow: 'notify_cmd' from os.environ.get (line 131, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

notify_cmd = os.environ.get("NOTIFY_COMMAND")
    if not notify_cmd:
        raise ValueError("NOTIFY_COMMAND not set for command channel")
    proc = subprocess.run([notify_cmd, target, message], capture_output=True, text=True)
    if proc.returncode != 0:
        err = (proc.stderr or proc.stdout or "").strip()
        raise RuntimeError(f"command notify failed: {err}")

• Confidence: 98% confidence
• Finding: This is a real tainted-flow issue: NOTIFY_COMMAND is read directly from the environment and then executed as a process. In a CI, agent, or orchestrated trading environment, environment variables are often externally controlled or inherited, so this creates a straightforward arbitrary code execution primitive.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The documented purpose emphasizes trading workflows, but the broader behavior includes arbitrary webhook notifications, execution of an external command from `NOTIFY_COMMAND`, and subprocess-based polling. In a skill that holds high-privilege trading credentials, any undocumented command execution or outbound notification path materially increases risk because it can be abused for secret exfiltration, unauthorized data transmission, or unsafe local command execution.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: For an order-monitoring notification script, a generic command-execution backend is broader than necessary and meaningfully increases attack surface. In the context of a crypto execution skill, arbitrary external command execution is more dangerous because the runtime may hold API keys, account data, and network access to exchanges or internal systems.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This script performs a destructive trading action by canceling a master order immediately after parsing CLI arguments, with no interactive confirmation, dry-run mode, or secondary safeguard. In a crypto execution context, accidental invocation, wrong order IDs, or automation mistakes can directly disrupt execution strategy, create slippage or missed fills, and cause financial loss.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This script submits real exchange orders and may also cancel one leg as part of rollback, yet it provides no explicit confirmation prompt, dry-run safeguard, or prominent warning before executing trading actions. In a crypto execution skill, this is especially dangerous because a user or calling agent can trigger irreversible market activity, fees, slippage, or unintended exposure simply by invoking the script with valid parameters.

Static analysis

No suspicious patterns detected.