Security audit

AutoTradeResearch

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate trading backtesting research skill, but it runs autonomous coding agents and generated Python with broad shell/edit authority, so it needs careful review before use.

Install only in a clean, isolated workspace with no sensitive files, credentials, broker sessions, or exchange keys available. Review generated strategy.py before running backtests, prefer pinned local datasets over the automatic yfinance fallback when reproducibility matters, and do not use this for live trading or account-connected workflows.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill explicitly instructs the agent to inspect and modify files in `workspace/`, but it does not declare permissions. That mismatch can bypass user/operator expectations and weakens security review, because a seemingly low-privilege skill is actually capable of reading and writing local files during autonomous operation.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: When the local CSV is missing, the evaluator reaches out to Yahoo Finance over the network and writes the fetched data into the workspace. That breaks the stated bounded-workspace/fixed-evaluator model and creates an external dependency that can leak execution metadata, reduce reproducibility, and expand the runtime attack surface beyond local files.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The evaluator imports and executes agent-controlled Python from agent/strategy.py via importlib, which gives that file arbitrary code execution at import time and during strategy execution. In an agent workspace, this is especially dangerous because the strategy can read or modify files, invoke subprocesses, access the network, or tamper with results, defeating the idea of a fixed backtesting evaluator.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script invokes an external coding agent with shell access and file-edit permissions, and does so in a fully non-interactive mode (`--ask-for-approval never`, `dontAsk`, `allowedTools Read,Edit,Bash`). Although there is some containment attempt via the agent directory and post-run drift checking, the agent still receives Bash capability over the workspace and can execute arbitrary commands during the run, which is risky if prompts, model behavior, or workspace contents are adversarial.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: workspace/run_backtest.py:205