T08 · Insecure Dependencies
Error
- Location
SKILL.md:9- Finding
Attacker-Controlled Skill Slug Solicits Unnecessary Exchange Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
BitoPro Spot (Security Research PoC)
Security checks for vulnerabilities and agentic risk
Overview
This package should be reviewed carefully because it presents itself as a BitoPro trading integration while also saying it is an attacker-controlled slug-takeover proof of concept and requiring real exchange credentials.
Do not enter real BitoPro API credentials into this package. Treat it as a slug-takeover research artifact, not a verified exchange integration; revoke any credentials already supplied and use only publisher-verified packages for trading or account access.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The manifest presents the package as a legitimate BitoPro trading skill while the body explicitly states it is an attacker-controlled proof of concept for an unclaimed slug takeover. This mismatch can socially engineer users into supplying exchange API credentials to a package that impersonates an official integration, creating a direct credential theft and account compromise risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill requests highly sensitive exchange credentials capable of accessing balances and trading functions, yet the top-level description does not prominently warn users about the financial and account-level consequences of private operations. In the context of a spoofed or attacker-controlled skill, requesting API key and secret materially raises the risk from mere confusion to account takeover and unauthorized trading.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The tool documentation describes live exchange operations such as balance access and trading endpoints, reinforcing the false appearance of a real BitoPro integration despite the file admitting it is only a takeover PoC. This increases the likelihood that a user will trust the package, provide credentials, and potentially authorize dangerous account actions under false pretenses.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 64% confidence
- Finding
The description states that the skill supports TWD fiat trading pairs, which imposes a specific locale/currency context in natural language. The file does not clarify that this is optional user-selected behavior or a justified regional limitation.
- Content
Static analysis
No suspicious patterns detected.