LTP RapidX Config

• Outcome: Review
• Latest audit: Jul 3, 2026 · 8:39 PM UTC
• Version: 1.0.16

Overview

This skill is not malware, but installing it can give an agent with production RapidX credentials access to live trading actions and may persist those credentials in agent or MCP configuration.

Install only if you intend this agent environment to have RapidX production-account access. Prefer least-privileged or read-only credentials where possible, use a host secret manager or environment references instead of writing real keys into MCP config, avoid shared workspaces for production keys, and require explicit preview plus confirmation before any live trade, cancel, position close, leverage, position-mode, algo, or automation action.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: This configuration/setup skill is presented as supporting read-only review, but it explicitly validates the presence of write-capable trading, order, position-close, algo, and automation tools. Even if it does not directly instruct executing those writes here, normalizing and verifying dangerous capabilities in a setup-only workflow increases the chance an agent will overreach its intended scope or later invoke live-trading functions under the banner of 'self-check'. The mismatch between declared purpose and validated capability surface is a real security boundary problem.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill includes live trading and automation capabilities in the 'healthy MCP discovery' set even though the skill is supposed to be configuration-only. That broadens the trusted surface area and teaches the agent that successful setup includes access to operational trading tools, which is unnecessary for installation review and dangerous in an environment holding production credentials. In a financial context, unnecessary validation of live-write pathways materially raises risk.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The file materially expands the skill from setup/configuration into full trading, order management, position management, and algo-order capabilities. In an agent setting, this scope mismatch is dangerous because downstream planners may treat the reference as authorization guidance and invoke live state-changing actions that the manifest description did not clearly signal.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This section documents live order placement, replacement, cancellation, and cancel-all operations without an explicit warning that they affect real accounts and can immediately change market exposure. In an agent workflow, omission of such warnings increases the chance of accidental destructive execution, especially where command tables are presented as normative guidance.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The position-management section includes close and close-all operations that can instantly liquidate exposure, but it lacks explicit risk messaging about irreversible live-account effects. Because the document is framed as an agent planning reference, these terse mappings can normalize execution of highly destructive actions without sufficient guardrails.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Changing position mode is a live account configuration change that can alter how future trades and hedging behavior work, yet the document presents it without warning. For agent use, this can lead to unintended account-state drift or incompatible downstream trading behavior.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The algo-order section exposes live placement, replacement, and cancellation of algorithmic orders without an explicit safety warning. This is dangerous because algo orders may persist and execute later, so an agent could create delayed or automated market actions with real financial consequences.

Session Persistence

Medium

• Category: Rogue Agent

Content

Ask whether the user wants to provide credentials as a user-provided chat secret. This is the default path for non-programmers, but state the risk first: even protected chat-secret flows are controlled by the agent host and may be subject to that host's retention, access, or collaboration settings.

If the agent host has a dedicated chat-secret UI, ask the user to create three secrets with the exact names `LTP_ACCESS_KEY`, `LTP_SECRET_KEY`, and `LTP_API_HOST`. If the host has no chat-secret UI, ask whether the user wants the agent to write masked-reference placeholders into MCP config or whether they prefer to set local environment variables manually.

Offer alternatives when the user wants stronger isolation:

• Confidence: 88% confidence
• Finding: create three secrets with the exact names `LTP_ACCESS_KEY`, `LTP_SECRET_KEY`, and `LTP_API_HOST`. If the host has no chat-secret UI, ask whether the user wants the agent to write masked-reference plac

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:253