T09 · Insecure Skill Coding Practices
Error
- Location
scripts/code_validator.py:119- Finding
Strategy Validation Executes Untrusted Python Code
- Content
View full analysis
- Remediation
View remediation
Security audit
vibetrading-ai-trading-code-generator
Security checks for vulnerabilities and agentic risk
Overview
This skill is a crypto trading code generator, but it needs review because it can lead users to run live trading code with real credentials and includes unsafe execution and unreliable API behavior.
Review this skill carefully before use. Do not run generated strategies with real exchange keys until the code and API wrapper are manually audited. Use testnet or paper trading first, use restricted no-withdrawal API keys with small limits, and treat every generated or downloaded strategy file as untrusted executable Python. Avoid running the validator or backtester on untrusted strategy files outside a sandbox, and be careful with the documented cleanup command because it permanently deletes local logs, sessions, and simulation results.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/backtest_runner.py:23- Finding
Backtest Interfaces Execute Strategy Files Without Isolation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
api_wrappers/hyperliquid_api.py:82- Finding
Live API Errors Silently Fall Back to Fabricated Market Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (61)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 94% confidence
- Finding
The rm -rf logs/* simulation_results/* sessions/* command is a destructive shell instruction that can be abused or misused, especially if executed from an unexpected directory or modified by users. In a skill that encourages command copying from documentation, destructive commands deserve heightened scrutiny because users may run them without understanding the data-loss implications.
- Content
清理临时文件
bash # 清理日志和临时文件 rm -rf logs/* simulation_results/* sessions/*保留的文件
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This finding describes the most dangerous mismatch: a skill framed as code generation may actually execute a live trading strategy, place/cancel orders, monitor markets continuously, read API credentials from environment variables, and write logs/status files. In the context of cryptocurrency trading, unexpected live order execution can directly cause financial loss, credential misuse, or unauthorized market activity, making the mismatch especially severe.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding describes the most dangerous mismatch: a skill framed as code generation may actually execute a live trading strategy, place/cancel orders, monitor markets continuously, read API credentials from environment variables, and write logs/status files. In the context of cryptocurrency trading, unexpected live order execution can directly cause financial loss, credential misuse, or unauthorized market activity, making the mismatch especially severe.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding describes the most dangerous mismatch: a skill framed as code generation may actually execute a live trading strategy, place/cancel orders, monitor markets continuously, read API credentials from environment variables, and write logs/status files. In the context of cryptocurrency trading, unexpected live order execution can directly cause financial loss, credential misuse, or unauthorized market activity, making the mismatch especially severe.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding describes the most dangerous mismatch: a skill framed as code generation may actually execute a live trading strategy, place/cancel orders, monitor markets continuously, read API credentials from environment variables, and write logs/status files. In the context of cryptocurrency trading, unexpected live order execution can directly cause financial loss, credential misuse, or unauthorized market activity, making the mismatch especially severe.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding describes the most dangerous mismatch: a skill framed as code generation may actually execute a live trading strategy, place/cancel orders, monitor markets continuously, read API credentials from environment variables, and write logs/status files. In the context of cryptocurrency trading, unexpected live order execution can directly cause financial loss, credential misuse, or unauthorized market activity, making the mismatch especially severe.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding describes the most dangerous mismatch: a skill framed as code generation may actually execute a live trading strategy, place/cancel orders, monitor markets continuously, read API credentials from environment variables, and write logs/status files. In the context of cryptocurrency trading, unexpected live order execution can directly cause financial loss, credential misuse, or unauthorized market activity, making the mismatch especially severe.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding describes the most dangerous mismatch: a skill framed as code generation may actually execute a live trading strategy, place/cancel orders, monitor markets continuously, read API credentials from environment variables, and write logs/status files. In the context of cryptocurrency trading, unexpected live order execution can directly cause financial loss, credential misuse, or unauthorized market activity, making the mismatch especially severe.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding describes the most dangerous mismatch: a skill framed as code generation may actually execute a live trading strategy, place/cancel orders, monitor markets continuously, read API credentials from environment variables, and write logs/status files. In the context of cryptocurrency trading, unexpected live order execution can directly cause financial loss, credential misuse, or unauthorized market activity, making the mismatch especially severe.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding describes the most dangerous mismatch: a skill framed as code generation may actually execute a live trading strategy, place/cancel orders, monitor markets continuously, read API credentials from environment variables, and write logs/status files. In the context of cryptocurrency trading, unexpected live order execution can directly cause financial loss, credential misuse, or unauthorized market activity, making the mismatch especially severe.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This finding describes the most dangerous mismatch: a skill framed as code generation may actually execute a live trading strategy, place/cancel orders, monitor markets continuously, read API credentials from environment variables, and write logs/status files. In the context of cryptocurrency trading, unexpected live order execution can directly cause financial loss, credential misuse, or unauthorized market activity, making the mismatch especially severe.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This finding describes the most dangerous mismatch: a skill framed as code generation may actually execute a live trading strategy, place/cancel orders, monitor markets continuously, read API credentials from environment variables, and write logs/status files. In the context of cryptocurrency trading, unexpected live order execution can directly cause financial loss, credential misuse, or unauthorized market activity, making the mismatch especially severe.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This finding describes the most dangerous mismatch: a skill framed as code generation may actually execute a live trading strategy, place/cancel orders, monitor markets continuously, read API credentials from environment variables, and write logs/status files. In the context of cryptocurrency trading, unexpected live order execution can directly cause financial loss, credential misuse, or unauthorized market activity, making the mismatch especially severe.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This finding describes the most dangerous mismatch: a skill framed as code generation may actually execute a live trading strategy, place/cancel orders, monitor markets continuously, read API credentials from environment variables, and write logs/status files. In the context of cryptocurrency trading, unexpected live order execution can directly cause financial loss, credential misuse, or unauthorized market activity, making the mismatch especially severe.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file-level documentation claims this is a Hyperliquid API wrapper, but the implemented authenticated trading behavior follows another exchange’s model. That discrepancy can mislead downstream agents or users into generating and running production trading code under false assumptions, which is especially risky in an automated trading skill where trust in API semantics directly affects fund safety.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This wrapper advertises Hyperliquid support but implements Binance-style authentication headers and request-signing conventions for account and trading operations. In a code-generation skill for live trading bots, this mismatch is dangerous because users may believe orders and account actions are correctly integrated when they are not, leading to failed trades, undefined behavior, or accidental execution against an unintended API pattern.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The engine loads and executes an arbitrary Python file via importlib.util.spec_from_file_location(...).exec_module(), which gives the supplied strategy full code execution with the privileges of the running process. In this skill context, that is especially dangerous because the manifest presents the skill as code generation for trading strategies, not as a general-purpose executor for untrusted Python, so users may not expect arbitrary local code execution.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The function dynamically loads a Python file using importlib and executes it with spec.loader.exec_module(strategy_module), which runs top-level code from the supplied file. If an attacker can influence strategy_file, they can achieve arbitrary code execution on the host, which is especially dangerous in a code-generation/trading skill where users may supply or generate strategy code.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The runner dynamically imports and executes any Python file supplied as a strategy, which means arbitrary code in that file runs with the permissions of the user invoking the backtester. In this skill's context, strategies are generated from natural-language prompts and may be treated as data, so users could be tricked into executing malicious payloads disguised as trading logic.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python for key, value in params.items(): instructions += "- **{key}**: {value}\n" return instructions
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The import-check routine dynamically imports the user-supplied strategy module in a subprocess, which executes module-level Python code. Because generated strategy files are effectively untrusted input in this skill, a crafted file can trigger arbitrary code execution, network access, filesystem changes, or secret exfiltration during 'validation', defeating the expectation of passive analysis.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The temporary test script imports the target module solely to detect import errors, but importing Python modules executes top-level code. In a code-generation skill for trading strategies, the produced file may contain arbitrary logic, so this check can unintentionally execute attacker-controlled code with the validator's privileges and environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly instructs users to execute generated trading bot code, but provides no warning that the code may place real orders, use live API credentials, or cause financial loss. In the context of an automated trading code generator, this omission is especially risky because users may treat generated strategies as safe to run directly on a live exchange.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README provides a destructive cleanup command using rm -rf against multiple directories without warning users about irreversible deletion or advising them to verify the target paths. Even though the paths appear scoped to project subdirectories, copy-paste use and directory confusion could still lead to accidental loss of logs, session data, or simulation outputs.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises and documents capabilities that involve environment-variable access, filesystem reads/writes, shell execution, and network/API interaction, but it does not declare any explicit tool scope or permission boundaries. In a trading-oriented skill that can touch credentials and potentially execute generated or auxiliary scripts, missing scope declarations increase the risk of unintended high-impact actions and make review, enforcement, and least-privilege controls much harder.
- Content
Static analysis
No suspicious patterns detected.