Grvt Markets

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:06 PM UTC
• Version: 1.0.0

Overview

This is a disclosed GRVT trading skill, but it asks users to trust an unaudited global CLI with live exchange credentials, private-key signing, fund movement, withdrawals, and confirmation bypasses.

Review this carefully before installing. Use only testnet or low-value accounts, avoid production funds unless you have audited the exact CLI version, do not pass real API keys or private keys as command-line arguments, avoid --yes on trading or fund-moving commands, and prefer restricted credentials that cannot withdraw assets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:14
• Finding: Unpinned and Unaudited Third-Party Package Receives Exchange and Wallet Authority## Vulnerability Details **File Location**: `SKILL.md:14-24, 38-42` **Vulnerability Type**: Unpinned and unaudited third-party dependency **Risk Level**: High ### Vulnerable Code ```markdown > **IMPORTANT: Community Project Disclaimer** > > `grvt-cli` is a **community hobby project**. It is **NOT** officially supported, endorsed, audited, or maintained by the GRVT team. No security audit or formal code review has been performed. > > **The code has not been audited for security vulnerabilities. By using this tool the user acknowledges and accepts the risk of total loss of funds.** > > The user is solely responsible for any financial losses, leaked credentials, or unintended trades that may result from using this software. > > This tool stores API keys and private keys in plaintext on disk (with `0600` file permissions). Keys should never be shared or used on untrusted machines. > > **Before using this CLI on behalf of the user, you MUST inform them of this disclaimer and get their explicit acknowledgment.** ``` ```bash pnpm add -g @madeinusmate/grvt-cli ``` ### Technical Analysis The Skill instructs users to globally install `@madeinusmate/grvt-cli` from npm without specifying an exact version, lockfile integrity value, package signature, or other provenance control. The documentation explicitly states that the package is an unaudited community project. The installed package is subsequently trusted with an exchange API key, session cookie, Ethereum private key, authenticated financial information, order placement authority, fund-transfer authority, and withdrawal authority. A package release can change after this Skill has been reviewed because the installation command resolves the currently published version. The package implementation is not included in this project, so this audit cannot verify its runtime behavior. There is no evidence in the reviewed Skill files that the current npm package is malicious; ...[truncated 1620 chars]
• Remediation: ## Remediation Suggestions 1. Pin an exact, independently reviewed package version rather than resolving the latest release. 2. Use lockfile integrity hashes and verify package provenance or registry signatures before installation. 3. Vendor and audit the exact executable source used by the Skill. 4. Avoid global installation; use a project-local, sandboxed dependency with minimal filesystem and network access. 5. Disable package lifecycle scripts during installation where operationally possible. 6. Require testnet by default and make production activation a separate, explicit user action. 7. Use restricted API credentials that expose only the permissions required for the requested operation. 8. Use a dedicated low-value wallet or hardware-backed signer rather than a general-purpose private key. 9. Re-audit every dependency update before changing the pinned version.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:22
• Finding: Long-Lived Exchange Credentials and Ethereum Private Key Are Stored in Plaintext## Vulnerability Details **File Location**: `SKILL.md:22, 76-84, 99-114`; `references/commands-config.md:136-156` **Vulnerability Type**: Plaintext storage of sensitive authentication and signing material **Risk Level**: High ### Vulnerable Code ```markdown > This tool stores API keys and private keys in plaintext on disk (with `0600` file permissions). Keys should never be shared or used on untrusted machines. ``` ```markdown Config file: `~/.config/grvt/config.toml` (permissions `0600`). | Key | Type | Default | Description | |-----|------|---------|-------------| | `env` | `dev\|staging\|testnet\|prod` | `prod` | GRVT environment | | `apiKey` | string | - | GRVT API key | | `privateKey` | string | - | Ethereum private key (0x-prefixed) for EIP-712 signing | | `subAccountId` | string | - | Default sub-account for trading commands | | `accountId` | string | - | Main account ID (set automatically on login) | | `cookie` | string | - | Session cookie (set automatically on login) | ``` ```markdown ## `grvt auth login` Authenticate with GRVT API. Stores session cookie and account ID in config. | Option | Required | Description | |--------|----------|-------------| | `--api-key <key>` | No (falls back to config) | GRVT API key | | `--private-key <key>` | No | Ethereum private key for EIP-712 signing | | `--env <env>` | No (falls back to config) | Environment override: `dev\|staging\|testnet\|prod` | ```bash # Full login grvt auth login --api-key YOUR_KEY --private-key 0xYOUR_KEY # Using config values grvt config set apiKey YOUR_KEY grvt auth login # Override environment for one login grvt auth login --env testnet ``` On success, stores: `cookie` (session), `accountId`, and optionally `privateKey` in the config file. ``` ### Technical Analysis The documented configuration design persistently stores an API key, session cookie, and optionally an Ethereum private key in an unencryp ...[truncated 2255 chars]
• Remediation: ## Remediation Suggestions 1. Store API keys and session cookies in an operating-system credential vault rather than a plaintext configuration file. 2. Do not persist Ethereum private keys by default. 3. Support hardware wallets, external signing services, or encrypted keystores that require explicit user authorization for each sensitive operation. 4. Separate read-only authentication from credentials capable of trading or withdrawal. 5. Request signing capability only when a user explicitly initiates a write operation. 6. Use short-lived sessions and rotate API credentials regularly. 7. Ensure logout invalidates server-side sessions in addition to deleting local values. 8. Exclude secret storage from backups and synchronization systems, or protect backups with authenticated encryption. 9. Preserve restrictive file permissions as defense in depth, but do not treat them as encryption. 10. Document secure deletion limitations affecting snapshots, journaled filesystems, and backups.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:54
• Finding: Agent-Oriented Authentication Exposes Secrets Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md:54-63, 99-102`; `references/commands-config.md:140-149` **Vulnerability Type**: Sensitive information supplied through process arguments **Risk Level**: High ### Vulnerable Code ```markdown The setup wizard displays a disclaimer requiring explicit acceptance before proceeding. It is interactive and reads sensitive input from stdin (keeping keys out of shell history). It walks through: environment, API key, private key, and default sub-account ID, then authenticates automatically. **Note:** Because `grvt setup` is interactive and requires user input, agents cannot run it directly. Use the manual setup flow below instead. Manual setup (recommended for agents): ```bash grvt config set env testnet grvt auth login --api-key YOUR_API_KEY --private-key 0xYOUR_PRIVATE_KEY grvt config set subAccountId YOUR_SUB_ACCOUNT_ID ``` ``` ```markdown **Login** requires an API key. A private key is optional but required for write operations (orders, transfers, withdrawals, derisk). ```bash grvt auth login --api-key KEY --private-key 0xKEY ``` ``` ### Technical Analysis The Skill recognizes that stdin protects private keys from shell history, but its recommended noninteractive agent workflow places both the API key and Ethereum private key directly in command-line arguments. Command-line secrets may be exposed through several channels: - Shell history when commands are executed through a shell. - Agent tool-call transcripts and execution logs. - Process-list inspection while the command is running. - Operating-system audit or process accounting facilities. - Terminal logging, observability agents, crash diagnostics, or telemetry. - CI/CD logs if the same instructions are used for automation. This is an avoidable exposure because authentication can be designed to read secrets from masked stdin, inherited file descriptors, or an operating-system secret store. ...[truncated 1137 chars]
• Remediation: ## Remediation Suggestions 1. Remove examples that place API keys or private keys directly in command-line arguments. 2. Add a noninteractive mode that reads secrets from masked stdin without echoing. 3. Support inherited file descriptors or operating-system credential-store references. 4. Ensure agent integrations provide a dedicated secret-input channel that is excluded from transcripts and telemetry. 5. Redact command invocations and process metadata in execution logs. 6. Avoid environment variables for long-lived private keys because they may also leak through process inspection, diagnostics, or child processes. 7. If argument-based login must remain for compatibility, display a prominent warning and disable it by default for production environments. 8. Rotate any credentials that have previously appeared in command histories, transcripts, or logs.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/commands-config.md:101
• Finding: Plaintext Export of All Credentials Supports Noninteractive Confirmation Bypass## Vulnerability Details **File Location**: `references/commands-config.md:101-115` **Vulnerability Type**: Unsafe plaintext secret export **Risk Level**: Medium ### Vulnerable Code ```markdown ## `grvt config export` Export config to a TOML file. | Option | Required | Description | |--------|----------|-------------| | `--file <path>` | **Yes** | Destination file path | | `--include-secrets` | No | Include secret values (prompts for confirmation) | | `--yes` | No | Skip confirmation prompt | ```bash grvt config export --file backup.toml grvt config export --file full-backup.toml --include-secrets --yes ``` ``` ### Technical Analysis The export functionality can write all secret configuration values to a portable TOML file. The `--yes` option suppresses the confirmation intended to protect the sensitive export. The documentation does not establish that exported secrets are encrypted, that restrictive file permissions are enforced, or that symlink, overwrite, and unsafe destination risks are prevented. As documented elsewhere in the Skill, secret values can include an API key, Ethereum private key, and session cookie. A portable plaintext copy increases the number of locations from which those credentials can be stolen and can easily be placed in a synchronized directory, source repository, shared workspace, artifact store, or unencrypted backup. ### Attack Path 1. A user, script, or agent runs the documented export command with `--include-secrets --yes`. 2. The CLI writes the API key, private key, and session cookie into `full-backup.toml`. 3. The file is created in or later copied to an insecure location, such as a shared directory, repository, cloud-synchronized folder, or build artifact. 4. Another party obtains the exported file. 5. The party extracts the credentials and uses them to access the account or authorize financial operations. A local attacker may also attempt to influence the destina ...[truncated 610 chars]
• Remediation: ## Remediation Suggestions 1. Remove secret export unless it is essential to the declared functionality. 2. If retained, encrypt exports using authenticated encryption and a user-supplied passphrase or hardware-backed key. 3. Do not permit `--yes` to bypass confirmation when `--include-secrets` is used in a production environment. 4. Create output files with restrictive permissions using exclusive and no-follow semantics. 5. Refuse to overwrite existing files or follow symbolic links without a separate explicit action. 6. Warn users against exporting into source repositories, shared directories, temporary folders, or cloud-synchronized paths. 7. Clearly identify which credentials are included before export without displaying their values. 8. Provide a secure credential migration mechanism that transfers secrets directly between protected stores instead of producing a plaintext intermediate file. 9. Recommend immediate credential rotation if an exported file is lost or disclosed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest description grants a very broad activation scope covering essentially any GRVT API interaction, including trading, withdrawals, transfers, leverage changes, and history queries. In an agent setting, over-broad triggering increases the chance the skill is invoked in contexts where the user did not clearly intend sensitive financial actions, which is risky given the tool can move funds and place orders.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `--pretty` | Pretty-print JSON | `false` |
| `--silent` | Suppress info logs | `false` |
| `--no-color` | Disable colors | - |
| `--yes` | Skip confirmation prompts | - |
| `--retries <n>` | Retry count | `3` |
| `--timeout-ms <n>` | Request timeout (ms) | `10000` |

• Confidence: 89% confidence
• Finding: Documenting a global `--yes` option that skips confirmation prompts is dangerous in a trading skill because it enables irreversible write actions without an interactive checkpoint. In this context, confirmations are one of the few safeguards preventing accidental or unauthorized orders, cancellations, transfers, or withdrawals.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

echo '{"order": {...}}' | grvt trade order create --json -
```

Skip confirmations for scripting:

```bash
grvt trade order cancel-all --yes --silent

• Confidence: 95% confidence
• Finding: The example explicitly recommends skipping confirmations for scripting on sensitive commands like `trade order cancel-all` and `funds transfer create`, which normalizes autonomous execution of destructive financial actions. In a skill that can trade and move funds, this materially increases the chance of accidental mass cancellation or unauthorized transfers without a final human check.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

|--------|----------|-------------|
| `--file <path>` | **Yes** | Destination file path |
| `--include-secrets` | No | Include secret values (prompts for confirmation) |
| `--yes` | No | Skip confirmation prompt |

```bash
grvt config export --file backup.toml

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: Although line L120 states that import overwrites all current config values, the section provides no explicit cautionary warning around this destructive behavior. Because config import can replace existing credentials and settings, the documentation should more clearly alert users before they run it.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The examples show API keys and Ethereum private keys passed directly as CLI arguments, which can expose secrets via shell history, terminal logging, audit logs, and process listings on multi-user systems. In a trading skill handling live exchange credentials and signing keys, disclosure could enable account takeover, unauthorized trading, or withdrawals.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

--from-sub-account-id 111 --to-sub-account-id 222 \
  --currency USDT --amount 100

# Skip confirmation for scripting
grvt funds transfer create \
  --from-sub-account-id 111 --to-sub-account-id 222 \
  --currency USDT --amount 50 --yes

• Confidence: 91% confidence
• Finding: The documentation explicitly shows use of `--yes` to bypass confirmation for a fund transfer operation, enabling fully automated movement of assets between sub-accounts. In a trading/funds-management skill, removing the human confirmation step materially increases the risk of unintended, unauthorized, or prompt-injected fund movements once authentication and signing are available.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

--to-address 0x1234567890abcdef1234567890abcdef12345678 \
  --currency USDT --amount 50

# Skip confirmation
grvt funds withdraw create \
  --to-address 0x1234...5678 --currency USDT --amount 50 --yes

• Confidence: 95% confidence
• Finding: The example demonstrates `--yes` for withdrawals, which suppresses the last manual checkpoint before funds are sent to an external Ethereum address. In the context of an agent skill capable of authenticated withdrawals and EIP-712 signing, this significantly lowers the barrier for prompt-injection, user-confusion, or logic errors to result in irreversible asset loss.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This documentation exposes high-risk state-changing trading operations such as leverage changes, cancel-on-disconnect configuration, and derisk settings without prominent warnings, guardrails, or explicit confirmation guidance about financial consequences. In an agent skill context, documentation like this can normalize or encourage automated execution of irreversible or loss-inducing actions, increasing the chance of accidental harmful trades or risk-setting changes.

Static analysis

No suspicious patterns detected.