VBrokers Trading

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent VBrokers trading helper, but it gives an agent live brokerage trading and cancellation abilities without clear confirmation or safety limits.

Install only if you intentionally want agent-assisted live trading through VBrokers. Keep the gateway local, avoid hard-coding real passwords, start with read-only quote/account checks, and add explicit per-order confirmation plus quantity, price, symbol, session, and market-status checks before allowing any live order, cancellation, stop-loss, or take-profit action.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation presents order placement and order cancellation as routine examples without an explicit warning that these actions can immediately affect live brokerage accounts and may be difficult or impossible to reverse once executed. In a trading skill, omission of such warnings materially increases the chance of accidental financial loss or unintended market actions.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The stop-loss/take-profit example goes beyond analysis and shows autonomous logic that can directly trigger a market sell order. Because it lacks a clear warning and does not require an explicit human confirmation step, it normalizes unattended trading behavior that could liquidate positions based on faulty data, bad thresholds, or simple implementation mistakes.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: This documentation exposes direct order placement and cancellation capabilities for a live trading gateway on localhost without clearly emphasizing that these actions can execute real financial transactions and cause immediate monetary loss. In an agent skill context, documenting these endpoints as routine operations increases the chance that an LLM-driven agent will place, modify, or cancel trades without sufficiently explicit user confirmation, safeguards, or simulation-mode checks.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal