Alpaca Trading

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:17 AM UTC
• Version: 2.1.0

Overview

This appears to be a legitimate Alpaca trading skill, but it gives an agent broad brokerage authority with weak scoping around live or destructive actions.

Install only if you intentionally want an agent to use your Alpaca account. Keep paper trading as the default, use restricted or paper API keys where possible, do not point the base URL at non-Alpaca domains, and require explicit readback confirmation before any POST, PATCH, DELETE, option exercise, cancel-all, or close-all action.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill clearly instructs the agent to use shell-based capabilities via curl and a sourced helper script, yet it declares no explicit permissions. In a trading skill, undeclared shell access is especially risky because it can place orders, access account data, and interact with credentials-bearing environment variables without an upfront permission boundary or user visibility.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README explicitly instructs users how to switch from paper trading to live trading but does not include any warning that this enables real-money transactions or that mistaken prompts/actions could cause financial loss. In an agent skill designed to place trades, this omission increases the chance that a user enables live mode without appreciating the consequences, especially in an automated or semi-automated execution context.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The trigger text is very broad and includes many generic finance terms such as buy, sell, call, put, positions, orders, and stock price, which can cause the skill to activate in contexts where the user did not intend to use Alpaca or place trades. In this skill's context, accidental invocation is more dangerous than usual because the skill is capable of executing real financial transactions and exposing sensitive account information.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This reference includes numerous real-money trading and account-changing examples, including order placement, liquidation, exercising options, and account configuration changes, without prominent warnings that these actions are live and financially destructive if run against a funded account. In an agent skill context, example commands often become templates for automation, so the absence of confirmation and safety guidance materially increases the risk of accidental unauthorized trades or account modifications.

External Transmission

Medium

• Category: Data Exfiltration

Content

URL="${BASE_URL}${ENDPOINT}"

# --- Build curl args ---
CURL_ARGS=(
  -s -w '\n%{http_code}'
  -X "$METHOD"

• Confidence: 95% confidence
• Finding: curl args --- CURL_ARGS=( -s -w '\n%{http_code}' -X "$METHOD" -H "APCA-API-KEY-ID: ${APCA_API_KEY_ID}" -H "APCA-API-SECRET-KEY: ${APCA_API_SECRET_KEY}" -H "Accept: application/json" ) if [[

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

alpaca PATCH /v2/orders/ORDER_ID '{"qty":"20","limit_price":"190.00"}'

# Cancel order
alpaca DELETE /v2/orders/ORDER_ID

# Cancel ALL open orders
alpaca DELETE /v2/orders

• Confidence: 88% confidence
• Finding: DELETE /v2/orders/ORDER_ID

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

alpaca GET /v2/positions/NVDA260417C00220000

# Close a position (market sell all)
alpaca DELETE /v2/positions/AAPL
# Close partial (by qty)
alpaca DELETE '/v2/positions/AAPL?qty=5'
# Close partial (by percentage)

• Confidence: 94% confidence
• Finding: DELETE /v2/positions/AAPL

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Close a position (market sell all)
alpaca DELETE /v2/positions/AAPL
# Close partial (by qty)
alpaca DELETE '/v2/positions/AAPL?qty=5'
# Close partial (by percentage)
alpaca DELETE '/v2/positions/AAPL?percentage=50'

• Confidence: 92% confidence
• Finding: DELETE '/v2/positions/AAPL?qty=5

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Close partial (by qty)
alpaca DELETE '/v2/positions/AAPL?qty=5'
# Close partial (by percentage)
alpaca DELETE '/v2/positions/AAPL?percentage=50'

# Close ALL positions
alpaca DELETE '/v2/positions?cancel_orders=true'

• Confidence: 93% confidence
• Finding: DELETE '/v2/positions/AAPL?percentage=50

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Examples:
#   alpaca GET /v2/account
#   alpaca POST /v2/orders '{"symbol":"AAPL","qty":"10","side":"buy","type":"market","time_in_force":"day"}'
#   alpaca DELETE /v2/orders/ORDER_ID
#   ALPACA_DATA=1 alpaca GET '/v2/stocks/AAPL/quotes/latest'
set -euo pipefail

• Confidence: 93% confidence
• Finding: DELETE /v2/orders/ORDER_ID

VirusTotal

61/61 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.