Security audit

Longbridge

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Longbridge finance/trading helper, but it asks agents to use sensitive brokerage access and unsafe install patterns with insufficient guardrails.

Review this before installing if you plan to connect a real Longbridge account. Prefer verified package-manager or pinned release installs over curl-to-shell, protect OAuth/session files, approve only needed scopes, and require explicit confirmation before any portfolio read or order submission.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: references/setup.md:10
Finding: Mutable Remote Installer Is Executed Directly by a Shell
Content: View full analysis
Vulnerability Details

File Location: references/setup.md:10
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash
curl -sSL https://github.com/longbridge/longbridge-terminal/raw/main/install | sh

Technical Analysis

The installation command downloads a shell script from the mutable main branch and immediately passes its contents to sh. It does not pin a commit or release, verify a checksum or cryptographic signature, save the script for inspection, or validate the content before execution.

Consequently, the code executed on a user's machine is not necessarily the code that existed when this Skill was reviewed. Hosting the script in the apparent upstream GitHub repository reduces neither the mutability of the resource nor the consequences of a compromised maintainer account, repository, release pipeline, or delivery path.

The command also suppresses normal curl output with -s, follows redirects with -L, and executes the resulting response regardless of whether the user reviewed it. This behavior is not required for the Skill's declared market-data, SDK, or trading functionality. A package-manager installation or verified release artifact would provide the same functionality with substantially lower risk.

Attack Path

An attacker compromises the upstream repository, a maintainer account, or the process controlling the main/install resource.

The attacker modifies the installer or redirects it to attacker-controlled shell content.

A user or AI agent follows the Skill's setup instructions.

curl retrieves the current attacker-controlled response and streams it directly into sh.

The payload executes with all permissions available to the invoking user.

The payload may read local files and environment variables, access cached Longbridge authentication material, modify user configuration, install additional programs, ...[truncated 787 chars]
Remediation: View remediation
Remediation Suggestions

Remove the pipe-to-shell installation method from the recommended setup flow.

Prefer a trusted package manager and pin an audited release version.

If a standalone installer is necessary, download a versioned release artifact to disk rather than retrieving it from a mutable branch.

Publish and verify a SHA-256 digest or, preferably, a cryptographic signature rooted in a separately managed signing key.

Fail closed if verification does not succeed.

Allow the user to inspect the downloaded installer before execution.

Install into a user-owned directory unless system-wide installation is explicitly required and approved.

Avoid silently invoking privilege escalation; explain any requested privileges and their purpose.

Document rollback, uninstall, and credential-revocation procedures.

T03 · Remote Payload Retrieval and Execution

Error

Location: references/cli/overview.md:24
Finding: Duplicate Mutable Remote Installer Instruction in CLI Documentation
Content: View full analysis
Vulnerability Details

File Location: references/cli/overview.md:24-26
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash
# Any platform (install script) curl -sSL https://github.com/longbridge/longbridge-terminal/raw/main/install | sh # Installs `longbridge` binary to /usr/local/bin

Technical Analysis

The CLI documentation independently recommends executing a remote script from the mutable main branch by streaming it directly into a shell. There is no commit or release pin, integrity digest, signature verification, or inspection step.

This occurrence additionally documents installation into /usr/local/bin, a shared executable search path. Placing an externally retrieved binary there increases the consequences of upstream compromise because future invocations of longbridge by users, scripts, or AI agents will resolve to the installed executable. Depending on local ownership and permissions, writing to this directory may also require elevated privileges.

The remote script is not included in the audited project, so its behavior cannot be established from the Skill contents. The Skill therefore delegates local code execution and installation behavior to content that may change after audit.

Attack Path

An attacker gains control of, or successfully modifies, the remote installer referenced by the mutable URL.

A user follows the cross-platform installation instructions.

The response is immediately interpreted by sh.

The script installs an attacker-modified executable or performs arbitrary additional actions.

If installation into /usr/local/bin succeeds, subsequent legitimate-looking longbridge commands execute the compromised binary.

That binary may access cached sessions, portfolio information, order APIs, local files, or network resources available to the user.

Impact Assessment

The immediate imp ...[truncated 609 chars]
Remediation: View remediation
Remediation Suggestions

Delete the direct curl | sh recommendation.

Make the documented Homebrew method, or another signed package-manager channel, the primary installation mechanism.

For unsupported platforms, reference an immutable, versioned release artifact rather than a branch URL.

Provide a separately published checksum and signature, with explicit verification commands.

Download and verify the artifact before any execution or extraction.

Default to a user-local executable directory. Require explicit informed consent before system-wide installation.

Do not let an installer self-update from mutable content without signature and version verification.

Clearly document the files created, permissions needed, authentication data accessed, and uninstall procedure.

T08 · Insecure Dependencies

Warning

Location: references/python-sdk/overview.md:5
Finding: Python SDK Installation Uses an Unpinned Package Release
Content: View full analysis
Vulnerability Details

File Location: references/python-sdk/overview.md:5-11
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
## Install ```bash pip install longbridge

Note: The package was previously named longport. If upgrading, run pip uninstall longport first.

text
### Technical Analysis The command installs whichever `longbridge` release the configured Python package index currently resolves as latest. It does not pin an audited version, use a lockfile, or require artifact hashes. As a result, the dependency selected during installation may differ from the version considered when the Skill documentation was reviewed. A compromised publisher account, package-index incident, or malicious future release could introduce altered code. Python packages may execute package-related code during installation, and imported SDK code runs with the application's permissions. This finding does not assert that the current `longbridge` package is malicious. It identifies the absence of reproducible, integrity-verified dependency resolution. ### Attack Path 1. An attacker compromises the package publisher, release process, or configured package index, or causes a malicious release to become the resolved version. 2. A user follows the documented `pip install longbridge` command. 3. pip downloads and installs the attacker-influenced package because no approved version or hash is enforced. 4. Malicious behavior runs during installation or when the package is imported. 5. The package accesses resources available to the Python process, potentially including environment-based credentials, OAuth tokens, local files, and network services. ### Impact Assessment Exploitation could execute code with the privileges of the user or service running pip or importing the SDK. In this project's intended usage, that process may have access to mark ...[truncated 286 chars]
Remediation: View remediation
Remediation Suggestions

Pin the SDK to a specifically reviewed version, such as longbridge==<reviewed-version>.

Maintain a lockfile or constraints file for reproducible dependency resolution.

Record hashes for the approved wheels and install with pip --require-hashes.

Prefer binary wheels from the expected package index and verify package provenance where supported.

Test upgrades in an isolated environment before changing the pinned version.

Install into a dedicated virtual environment under a non-privileged account.

Separate quote-only and trading-capable environments and credentials to minimize the impact of dependency compromise.

Document the trusted package index explicitly and avoid uncontrolled additional indexes.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (18)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest trigger is excessively broad: it activates on virtually any stock ticker mention, market-analysis request, portfolio-related phrase, CLI usage, SDK coding task, or Longbridge integration topic. This can cause the skill to intercept many unrelated conversations and unnecessarily gain access to sensitive financial context, increasing the chance of privacy violations, overcollection, and unsafe financial/trading guidance being injected where it was not explicitly requested.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The workflow explicitly instructs the agent to run longbridge positions and states it should always pull portfolio positions when the user asks about 'my portfolio,' but it provides no consent gate, identity check, data-minimization rule, or privacy warning. In a financial context, positions and account balances are highly sensitive; automatic retrieval can expose private holdings and enable downstream leakage into analysis, logs, or model context without sufficiently explicit authorization.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The | sh construct chains network input directly into a shell interpreter, eliminating validation boundaries and enabling arbitrary command execution from remote content. In a developer/AI-facing CLI guide, this is particularly risky because automation may repeat the exact pattern without human review, amplifying exploitation impact.
Content: Scanner excerpt · references/cli/overview.md (reported line 25)May include surrounding context.
brew install --cask longbridge/tap/longbridge-terminal

Any platform (install script)

curl -sSL https://github.com/longbridge/longbridge-terminal/raw/main/install | sh

Installs longbridge binary to /usr/local/bin

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/rust-sdk/types.md (reported line 206)May include surrounding context.
use longbridge::quote::SecuritiesUpdateMode;

SecuritiesUpdateMode::Add // Append securities SecuritiesUpdateMode::Remove // Remove securities SecuritiesUpdateMode::Replace // Replace all

text

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: Using | sh creates an immediate execution chain from untrusted remote content to the shell, removing any opportunity for review or integrity verification. In a skill aimed at developer tasks and CLI setup, this increases risk because users are likely to copy-paste commands directly into a terminal, making arbitrary code execution particularly plausible if the source is tampered with.
Content: Scanner excerpt · references/setup.md (reported line 10)May include surrounding context.
brew install --cask longbridge/tap/longbridge-terminal

Any platform

curl -sSL https://github.com/longbridge/longbridge-terminal/raw/main/install | sh

text
Authenticate:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation instructs users to fetch and immediately execute a remote script via curl ... | sh, which removes any opportunity to inspect the code before execution. In an AI-agent and terminal workflow context, this is especially dangerous because users or agents may copy and run it verbatim, enabling supply-chain compromise or arbitrary code execution if the upstream content or delivery path is ever tampered with.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The authentication section states that an OAuth session token is stored at a fixed local path but does not warn that this file is a sensitive credential artifact. On shared systems, in logs, screenshots, backups, or overly permissive filesystem setups, this can lead to credential theft and unauthorized API access.
Content: No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
Content: Scanner excerpt · references/mcp.md (reported line 35)May include surrounding context.
md
### OAuth Authorization Flow 1. Add the config and call any tool — this triggers the OAuth flow 2. Client opens a browser tab to Longbridge login & consent page 3. Sign in with your Longbridge account and approve scopes 4. Credentials are stored by the client; tokens refresh automatically

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 93% confidence
Finding: Stating that tools are 'automatically exposed to the AI' and that the AI can 'directly inspect and call all tools' describes broad, unrestricted capability exposure. In a financial/trading context, that is dangerous because the connected model may gain access to sensitive account data or invoke state-changing actions such as order placement unless the client enforces strict confirmation, allowlists, and least-privilege controls. The skill context makes this more dangerous because it covers portfolios, balances, and trading workflows across multiple markets.
Content: Scanner excerpt · references/mcp.md (reported line 51)May include surrounding context.
md
## Available MCP Tools When the MCP server is connected, available tools are automatically exposed to the AI — no hardcoded list needed. The AI can directly inspect and call all tools. If you need to know what tools are available, ask the AI to list the connected MCP tools, or check the official docs: https://open.longbridge.com

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/python-sdk/overview.md (reported line 34)May include surrounding context.
Register once:

bash
curl -X POST https://openapi.longbridge.com/oauth2/register \ -H "Content-Type: application/json" \ -d '{"client_name":"My App","redirect_uris":["http://localhost:60355/callback"],"grant_types":["authorization_code","refresh_token"],"response_types":["code"]}' # Response: {"client_id": "your-client-id", ...}

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation shows live order submission, replacement, and cancellation flows without any explicit warning that these calls can place or modify real trades against a brokerage account. In a skill that aggressively triggers on stock, portfolio, CLI, and SDK usage, this increases the chance an agent or user copies the example into a real environment and causes unintended financial transactions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: These examples show how to submit, replace, and cancel orders in a trading context without any prominent warning that the operations may affect a live brokerage account. In a skill explicitly designed to assist with Longbridge trading and SDK usage, users may copy and run the snippets directly, creating a realistic risk of unintended live trades or order modifications with financial loss.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The complete example performs an actual buy order after checking balances, but it does not warn that this can use real funds if the API credentials point to a production account. Because this is end-to-end sample code in a trading skill, it is especially likely to be copied verbatim, increasing the chance of unintended market orders or financial exposure.
Content: No source excerpt is available for this finding.

External Script Fetching

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: This command retrieves a script from an external source and executes it immediately, creating a classic remote code execution and supply-chain risk. Because the skill explicitly targets AI-agent tool-calling and scripting use cases, the chance of automated or unreviewed execution is higher, making the pattern more dangerous in context.
Content: Scanner excerpt · references/cli/overview.md (reported line 25)May include surrounding context.
brew install --cask longbridge/tap/longbridge-terminal

Any platform (install script)

curl -sSL https://github.com/longbridge/longbridge-terminal/raw/main/install | sh

Installs longbridge binary to /usr/local/bin

text

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 74% confidence
Finding: The file states that the CLI probes geotest.lbkrs.com on startup and caches the result locally, but it does not provide any caution that startup performs an automatic outbound network request and writes a cache file. Because this behavior can affect privacy and system state, a short warning would improve user disclosure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The example explicitly sets language(Language::EN) in the configuration, which imposes a specific language/locale in natural-language guidance. The file does not mention that this is optional, user-selectable, or justified by a region-specific requirement, so it appears to violate the policy against forcing a locale without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file includes a natural-language statement that Language::EN is the default, while also listing Chinese alternatives. Under the policy criteria, forcing a specific language without explicit user opt-in can be a locale-policy issue, and this section does not mention any user choice mechanism or justification for the default.
Content: No source excerpt is available for this finding.

External Script Fetching

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The documentation instructs users to fetch a remote installer script over the network and immediately execute it with the shell. This is dangerous because any compromise of the upstream repository, release pipeline, DNS/TLS interception point, or unexpected script change can result in arbitrary code execution on the user's machine with the user's privileges.
Content: Scanner excerpt · references/setup.md (reported line 10)May include surrounding context.
brew install --cask longbridge/tap/longbridge-terminal

Any platform

curl -sSL https://github.com/longbridge/longbridge-terminal/raw/main/install | sh

text
Authenticate:

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Remediation Suggestions

SkillSpector

Vague Triggers

Missing User Warnings

Chaining Abuse

Any platform (install script)

Installs longbridge binary to /usr/local/bin

Tool Parameter Abuse

Chaining Abuse

Any platform

Missing User Warnings

Missing User Warnings

Unrestricted Tool Access

Unrestricted Tool Access

External Transmission

Missing User Warnings

Missing User Warnings

Missing User Warnings

External Script Fetching

Any platform (install script)

Installs longbridge binary to /usr/local/bin

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

External Script Fetching

Any platform

Static analysis

Installs `longbridge` binary to /usr/local/bin

Installs `longbridge` binary to /usr/local/bin