ClawHub
Back to skill

Security audit

LTP RapidX Trading

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed RapidX trading integration with real financial risk, but the risky actions appear purpose-aligned and guarded by preview and explicit user authorization requirements.

Install only if you intend to let an agent interact with a live trading account. Keep automation sessions narrow, short-lived, and low-notional; avoid enabling bulk cancel-all or close-all unless you explicitly want that capability, and review previews carefully before authorizing live actions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
This capability overview enumerates live trading, cancellation, leverage, position close, close-all, and algo order actions without prominent safety framing, explicit live-trading warnings, or mandatory preview/confirmation guidance adjacent to the destructive operations. In an agent skill context, that omission is dangerous because agents may treat the document as operational guidance and invoke high-impact tools that can immediately alter a user's portfolio or realize losses.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
Preview ids are runtime-local. Use MCP preview ids only with the same MCP server runtime. Use CLI preview ids only with the same CLI preview store. Do not cross-submit MCP preview ids through CLI, or CLI preview ids through MCP.

Automation session still requires preview. Use it only when the user explicitly enables RapidX automation in chat and authorizes symbol, per-order max notional, total max notional, duration, allowed actions, and allowed order types. For normal order lifecycle automation, use `allowedActions=["order.place","order.replace","order.cancel"]`. First create a session with `rapidx/automation/start`; the input must include `explicitUserConsent=true` and `acceptedRiskText` copied from the user's authorization. Then add `automationSessionId` to order place/replace/cancel preview input. If the preview returns `automationSession.confirmationMode="automation-session"` and `confirmation.submitToken`, submit that preview without asking for another per-order chat confirmation. Do not invent automation scope. If no matching session exists, create one only after user authorization. If multiple sessions match, ask which session to use or pass the intended `automationSessionId`.

Automation session flow:
Confidence
93% confidence
Finding
without asking

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## 12. Automation

Automation is a bounded local authorization session. It lets the Agent submit matching previews without asking for another per-order chat confirmation.

Automation still requires preview.
Confidence
84% confidence
Finding
without asking

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| `rapidx order place` | `rapidx/order/place` | `POST /api/v1/trading/order` |
| `rapidx order replace` | `rapidx/order/replace` | `PUT /api/v1/trading/order` |
| `rapidx order cancel` | `rapidx/order/cancel` | `DELETE /api/v1/trading/order` |
| `rapidx order cancel-all` | `rapidx/order/cancel-all` | `DELETE /api/v1/trading/cancelAll` |
| `rapidx order query` | `rapidx/order/query` | `GET /api/v1/trading/order` |
| `rapidx order open-orders` | `rapidx/order/open-orders` | `GET /api/v1/trading/orders` |
| `rapidx order history` | `rapidx/order/history` | `GET /api/v1/trading/history/orders` |
Confidence
87% confidence
Finding
DELETE /api/v1/trading/cancelAll`

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| `rapidx position history` | `rapidx/position/history` | `GET /api/v1/trading/history/position` |
| `rapidx position get-leverage` | `rapidx/position/get-leverage` | `GET /api/v1/trading/perp/leverage` |
| `rapidx position set-leverage` | `rapidx/position/set-leverage` | `POST /api/v1/trading/position/leverage` |
| `rapidx position close` | `rapidx/position/close` | `DELETE /api/v1/trading/position` |
| `rapidx position close-all` | `rapidx/position/close-all` | `DELETE /api/v1/trading/positions` |

`position.close` does not take `side` or `quantity`. In NET mode, omit `positionSide`; in HEDGE mode, pass the actual `LONG` or `SHORT` side.
Confidence
84% confidence
Finding
DELETE /api/v1/trading/position`

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| `rapidx position get-leverage` | `rapidx/position/get-leverage` | `GET /api/v1/trading/perp/leverage` |
| `rapidx position set-leverage` | `rapidx/position/set-leverage` | `POST /api/v1/trading/position/leverage` |
| `rapidx position close` | `rapidx/position/close` | `DELETE /api/v1/trading/position` |
| `rapidx position close-all` | `rapidx/position/close-all` | `DELETE /api/v1/trading/positions` |

`position.close` does not take `side` or `quantity`. In NET mode, omit `positionSide`; in HEDGE mode, pass the actual `LONG` or `SHORT` side.
Confidence
94% confidence
Finding
DELETE /api/v1/trading/positions`

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.