ClawHub
Back to skill

Security audit

vibetrading-global-signals

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed utility for fetching public crypto trading-signal data, with no evidence of credential access, local data collection, hidden execution, or automatic persistence.

Before installing, understand that this skill fetches public crypto signal data from vibetrading.dev and displays it for review. Treat the results as informational only, verify them independently, and do not rely on them as financial advice. Review or update the npm dependencies before use in a sensitive environment.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (19)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The core behavior mostly aligns with the description at a high level: the script queries trading signals related to whale activity, news, funding rates, and technical indicators from a VibeTrading API. However, there are material discrepancies. The declared description suggests a generic capability to query AI-generated trading signals from 'vibetrading-datahub,' while the actual code is specifically a Node.js CLI utility that requires command-line arguments (`symbol`, `signal_type`, optional `limit`, `hours`) and calls a concrete external endpoint at `https://vibetrading.dev/api/v1/signals/...`. The description also frames the signals as produced by autonomous agents, but the code does not verify or implement that provenance—it simply fetches and displays API results. The primary purpose is close, but the undeclared CLI trigger and more specific resource access make this a mismatch under the stated criteria.

Ae1

High
Category
analysis-evasion
Content
- `scripts/get_latest_signals.js` - Get latest signals for multiple symbols
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- `scripts/get_latest_signals.js` - Get latest signals for multiple symbols
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- `scripts/get_latest_signals.js` - Get latest signals for multiple symbols
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- `scripts/get_latest_signals.js` - Get latest signals for multiple symbols
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- `scripts/get_latest_signals.js` - Get latest signals for multiple symbols
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- `scripts/get_signals_by_symbol.js` - Get signals for a specific symbol
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- `scripts/get_signals_by_symbol.js` - Get signals for a specific symbol
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- `scripts/get_signals_by_symbol.js` - Get signals for a specific symbol
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- `scripts/get_signals_by_type.js` - Get signals by symbol and type
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- `scripts/get_signals_by_type.js` - Get signals by symbol and type
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- `scripts/get_signals_by_type.js` - Get signals by symbol and type
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Known Vulnerable Dependency: axios==1.13.5 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
96% confidence
Finding
The lockfile pins axios 1.13.5, and the provided advisories include high-severity issues such as NO_PROXY hostname normalization bypass leading to SSRF, plus prototype-pollution-related MITM/credential theft scenarios. In a skill whose purpose is to query remote trading-signal services, an HTTP client is directly security-relevant, so vulnerable request handling increases risk of server-side request forgery, proxy bypass, credential leakage, or tampered responses if untrusted URLs, redirects, or proxy settings are involved.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High
Category
Supply Chain
Confidence
81% confidence
Finding
form-data 4.0.5 is reported as vulnerable to CRLF injection via unescaped multipart field names and filenames. This is only exploitable if the skill constructs multipart requests using attacker-controlled field names or filenames, but as a dependency of axios it remains a real supply-chain risk that could enable header/body injection or malformed upstream requests in certain code paths.

Known Vulnerable Dependency: axios==1.13.5 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
87% confidence
Finding
The manifest permits installation of an axios version identified by the scanner as vulnerable, including SSRF-related and MITM/prototype-pollution-associated advisories. In a skill that queries external data sources and may operate through proxies, HTTP client flaws are more dangerous because they can affect request routing, credential handling, and trust boundaries when fetching trading signals.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill promotes using AI-generated trading signals in monitoring and strategy workflows without a prominent warning that outputs may be inaccurate, stale, manipulative, or not financial advice. In this context, users may over-trust autonomous agent output and make real financial decisions based on unverified signals, creating meaningful risk of monetary loss.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low
Category
Supply Chain
Confidence
88% confidence
Finding
follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. Because axios depends on this package and this skill communicates with external trading-signal infrastructure, a malicious or compromised endpoint could potentially trigger redirect-based exfiltration of bearer tokens or other sensitive headers.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"author": "",
  "license": "ISC",
  "dependencies": {
    "axios": "^1.6.0",
    "https-proxy-agent": "^7.0.6"
  },
  "engines": {
Confidence
40% confidence
Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"license": "ISC",
  "dependencies": {
    "axios": "^1.6.0",
    "https-proxy-agent": "^7.0.6"
  },
  "engines": {
    "node": ">=18.0.0"
Confidence
40% confidence
Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Static analysis

No suspicious patterns detected.