Edge.Trade

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:05 AM UTC
• Version: v4478.0.0

Overview

This skill is a real crypto trading integration, but it gives a downloaded external process an API key and order/wallet authority without clear safety gates.

Install only if you trust the Edge npm package and publisher, understand that the API key may permit real trading or wallet actions, and can restrict the key to the minimum permissions and limits needed. Treat every order or wallet operation as requiring explicit confirmation, and prefer a version-pinned package plus a safer secret-passing mechanism before using this with valuable accounts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: skill.yaml:17

Finding

Automatic Execution of an Unpinned Remote npm Package

Content

View full analysis

Vulnerability Details

File Location: skill.yaml, lines 17–21
Vulnerability Type: Unpinned third-party dependency executed through npx
Risk Level: High

Vulnerable Code:

yaml

mcp:
  servers:
    - name: edge
      command: npx
      args: ["-y", "@edgedottrade/edge", "--api-key", "${API_KEY}"]
      repository: "https://github.com/edgetrade/edge"

Technical Analysis

The Skill launches @edgedottrade/edge using npx -y without specifying an exact package version or verifying an integrity hash. As a result, npm can retrieve and execute whichever package version currently satisfies the implicit latest-version resolution.

The repository metadata does not cryptographically bind the downloaded npm package to the referenced GitHub repository. It therefore does not ensure that the executed artifact matches reviewed source code. The -y option also suppresses the normal installation confirmation, allowing the package to be downloaded and run automatically.

This creates a supply-chain trust boundary in which the effective executable can change after the Skill has been audited. A compromised npm publisher account, malicious package release, or registry compromise could introduce arbitrary code into subsequent executions.

Attack Path

1. An attacker compromises the npm publisher account, package, or relevant registry distribution path for @edgedottrade/edge.
2. The attacker publishes a malicious version that becomes the version resolved by the unpinned npx invocation.
3. The Skill starts the MCP server using npx -y @edgedottrade/edge.
4. npx downloads and executes the malicious package without interactive confirmation.
5. The package runs with the MCP process's local privileges, receives the Edge API key as an argument, and has outbound network access.
6. The malicious process can steal credentials, access locally available resources, communicate with attacker-controlled infr ...[truncated 725 chars]

Remediation

View remediation

Remediation Suggestions

• Pin @edgedottrade/edge to a specific, security-reviewed version rather than relying on implicit latest-version resolution.
• Verify the package with a lockfile and npm integrity metadata or a separately validated cryptographic digest.
• Install the reviewed dependency during a controlled build or deployment stage instead of downloading it dynamically at runtime.
• Remove -y where interactive approval is feasible, although confirmation alone is not a substitute for version and integrity pinning.
• Verify that the npm package provenance corresponds to the stated source repository and reviewed commit.
• Run the MCP server in a restricted sandbox with minimal filesystem, environment, process, and network access.
• Restrict outbound traffic to explicitly required Edge service endpoints.
• Apply an API key with the minimum required permissions and financial limits.
• Establish dependency monitoring and a controlled process for reviewing and upgrading the pinned version.

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.yaml:10

Finding

Secret API Key Exposed Through Process Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: skill.yaml, lines 10–13 and 19–20
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code:

yaml

config:
  - key: API_KEY
    description: Edge Trade API key (sk-...)
    required: true
    secret: true

yaml

    - name: edge
      command: npx
      args: ["-y", "@edgedottrade/edge", "--api-key", "${API_KEY}"]

Technical Analysis

The configuration correctly identifies API_KEY as a secret, but the value is interpolated directly into the child process argument vector through --api-key ${API_KEY}. Marking a configuration value as secret does not protect it after it is copied into command-line arguments.

Depending on the host operating system and runtime environment, process arguments may be visible through process-inspection interfaces, administrative tooling, container or orchestration diagnostics, telemetry agents, debug output, crash reports, shell wrappers, or command-execution logs. Any component that records or reads the complete command line may consequently obtain the API key.

Exploitation requires access to a process-inspection or logging channel that exposes the argument vector. The finding does not establish that such access is universally available, but the configuration unnecessarily broadens the credential's exposure surface.

Attack Path

1. A user or automation system starts the Skill.
2. The runtime substitutes the secret value into the --api-key command-line argument.
3. The complete argument vector becomes available to a local process-inspection interface, diagnostics collector, orchestration platform, crash reporter, or execution log.
4. An attacker with access to that interface or collected output extracts the API key.
5. The attacker submits the stolen key to the Edge service or another compatible endpoint.
6. The attacker performs data-access, wal ...[truncated 890 chars]

Remediation

View remediation

Remediation Suggestions

• Do not interpolate secret values into process command-line arguments.
• Modify the MCP server to read the API key from a dedicated environment variable, protected standard-input channel, operating-system credential facility, or secret-manager integration.
• Ensure the package does not print, serialize, or include the secret in errors and diagnostic messages.
• Redact credentials from process-launch logs, orchestration events, telemetry, crash reports, and debug output.
• Run the process under a dedicated least-privileged account and restrict access to process metadata.
• Scope the API key to only the required operations, accounts, networks, and transaction limits.
• Rotate the current key if it may already have appeared in process or diagnostic logs.
• Implement short credential lifetimes and automated revocation where supported.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly exposes order-placement and encrypted wallet-management capabilities but provides no warning, confirmation requirements, or safety constraints around asset-impacting actions. In an agent setting, this omission is dangerous because it can normalize autonomous trading or wallet interactions without making users aware of financial risk, irreversible transactions, or the need for explicit authorization.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes broad trading-related capabilities such as searching tokens, analyzing wallets, placing limit orders, and subscribing to alerts without clear activation boundaries or examples limiting when the skill should be invoked. In an agent setting, overly broad routing criteria increase the chance of unintended invocation for loosely related finance queries, which can expose users to unnecessary external calls, wallet analysis, or transactional flows they did not explicitly request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest advertises order-management and limit-order placement capabilities but provides no user-facing warning that the skill can perform impactful transactional actions. In the crypto trading context, unintended or ambiguous invocation is more dangerous because actions may cause real financial loss, irreversible blockchain transactions, or unauthorized order placement if the agent proceeds without strong confirmation boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest requires an API key and launches an external MCP process with outbound network access, yet it gives no user-facing disclosure that credentials will be provided to third-party code and potentially transmitted externally. This is especially sensitive here because the secret is passed to a spawned package that is fetched and executed dynamically, increasing the risk of credential exposure, misuse of trading APIs, or covert data exfiltration.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The MCP server is launched via npx -y @edgedottrade/edge without a pinned package version or integrity control, which means the installed code can change over time and may be replaced by a compromised or malicious release. Because this package is executed as an external process with network access and receives the API key on the command line, a supply-chain compromise could lead to credential theft, arbitrary outbound access, and execution of attacker-controlled code in the agent environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.