Etrade Pelosi Bot

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:03 AM UTC
• Version: 1.0.0

Overview

This is a live brokerage automation skill with persistent scheduling and plaintext credential handling, and the artifacts show enough under-scoped safety controls to require review before installation.

Install only after reviewing the code and configuration paths carefully. Treat it as software that may place real brokerage orders, store broker and Telegram credentials locally, create recurring scheduled jobs, and act on external trade data. Use sandbox or paper trading first, keep credentials outside the repo where possible, restrict file permissions, verify all data sources before enabling automation, and confirm how to disable cron/systemd jobs and live order execution.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (88)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises and documents capabilities including environment-variable access, local file read/write, network access, and shell-based setup/cron execution, yet no explicit permissions are declared. This increases the chance that users or an execution platform will authorize broader behavior than expected without informed consent, especially because the skill also handles credentials and automation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The declared purpose focuses on mirroring congressional trades, but the documented behavior expands into scraping, Selenium automation, notifications, persistent storage, dependency installation, cron modification, and backtesting. This mismatch is dangerous because users may approve a seemingly narrow trading skill without realizing it can modify system state, maintain long-running automation, and access additional data sources and channels.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The setup script hard-codes E*TRADE API credential values into a generated config file, causing secrets to be stored in plaintext on disk and distributed with the skill. Even if these are sandbox credentials, embedding them in source/setup artifacts normalizes unsafe secret handling, can leak through version control or logs, and may enable unauthorized API use if the credentials are valid.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The module claims to fetch congressional trade data from official government sources, but the implemented Senate path falls back to a community-maintained GitHub JSON feed. In a trading automation skill, this is dangerous because downstream broker execution may act on unauthenticated, third-party data that could be stale, tampered with, or silently manipulated, creating a supply-chain integrity risk with financial consequences.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The class docstring states that it collects data from official sources, but the actual code uses community GitHub data for Senate trades and no official House implementation. This mismatch can mislead operators into granting the data a higher trust level than warranted, which is especially risky in a skill designed to mirror congressional trades with automated execution and risk management.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: This code processes congressional trade alerts into local JSON recommendations but never performs broker execution or any meaningful risk management, despite the skill metadata promising automated mirroring with execution controls. In a trading skill, this discrepancy is dangerous because operators may rely on assumed automation, monitoring, or safeguards that do not actually exist, leading to missed trades, unmanaged exposure, or incorrect operational decisions.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The module and class docstrings explicitly claim integration with an E*TRADE trading bot, but the implementation only reads alert files and writes recommendation files. In the context of an agent skill for automated trading, misleading documentation materially increases operational risk because users or orchestrators may assume live brokerage connectivity and execution semantics that are not present.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This file includes persistence and service-management functionality that modifies the host's scheduled execution state, which extends beyond the core business logic of mirroring trades. Even if intended for convenience, persistence mechanisms increase attack surface and can be abused to ensure repeated execution of compromised code.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill directly modifies local cron configuration, a host-management capability that is not clearly justified by the stated purpose of mirroring congressional trades. In a trading-related skill, silent scheduler management is more suspicious because it creates recurring execution without being central to broker logic.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The test helper reads Telegram bot credentials from the local configuration and exposes part of the bot token and the full chat ID in console output. Even partial credential disclosure increases secret exposure risk through terminal logs, CI logs, screenshots, or shared support output, and this functionality is unrelated to core broker execution or risk management.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This documentation promotes a fully automated pipeline that fetches signals, executes broker trades automatically, and schedules unattended operation via cron, but it does not place a prominent safety warning at the point of use about real-money execution, market risk, or the possibility of unintended live orders. In the context of an agent skill that may be run by users with minimal review, this materially increases the chance of accidental financial loss, especially because the text frames the system as 'ready for deployment' and provides streamlined commands for setup and automation.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The documentation describes automation that collects external data, stores it locally, sends Telegram alerts, and integrates with a broker trading bot, but it does not clearly warn users that running the system can create persistent scheduled tasks and trigger downstream trading-related actions. In an agent skill context, missing disclosure of system-impacting and data-writing behavior increases the risk of unintended execution and unsafe deployment.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The quick start guide includes what appear to be concrete API key and secret values directly in documentation without any warning that credentials must be treated as sensitive. In a broker-automation skill, exposed credentials are especially risky because users may reuse them, copy them into insecure locations, or mistakenly believe embedded secrets are safe defaults, potentially leading to unauthorized account or API access.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README instructs users to enable cron-based automated trading and order placement but does not clearly warn that these actions can trigger real, irreversible financial transactions with potential monetary loss. In a live-trading skill, omission of an explicit safety warning increases the chance of accidental deployment, misuse, or users testing against production broker accounts without understanding the consequences.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly promises automated broker execution but does not clearly warn that commands may place live trades against a real brokerage account. In this context, omission of a strong live-trading warning is especially dangerous because financial actions are irreversible in practice and can cause immediate monetary loss if misconfigured or triggered unexpectedly.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation instructs users to store broker API credentials in config/secrets.json without warning about local plaintext secret storage risks. Because this skill also uses shell scripts, cron, and persistent local files, compromised local access, backups, logs, or accidental file exposure could lead to theft of brokerage credentials and unauthorized trading activity.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script persists broker access credentials to a local JSON file in the working directory with no encryption, no permission hardening, and no user warning. In a trading automation skill, these tokens can enable unauthorized account access and order placement if the file is read by another local user, malware, backups, or accidental source-control inclusion.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation describes automated collection of congressional trades and integration with a broker trading bot for automated execution, but it does not prominently warn users that the skill can trigger real financial actions and modify system automation via cron. In a trading context, missing safety disclosures materially increases the chance of unintended trades, misuse, or deployment without informed consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The setup script collects a Telegram bot token and chat ID, then writes them directly into config/config.json on disk without warning the user or applying any access controls. Storing secrets in plaintext increases the risk of credential leakage through local compromise, backups, logs, or accidental repository commits.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The generated stop_trading.sh uses broad pkill -f patterns that may terminate unrelated processes whose command lines match run_bot.sh or python.*main.py. This can cause denial of service or accidental interruption of other workloads on the host, especially in shared development environments.

Missing User Warnings

High

• Confidence: 93% confidence
• Finding: The script’s default `check` path instantiates the trading bot and directly calls `bot.check_and_process_trades()` whenever broker authentication is present, with no interactive confirmation, dry-run guard, or explicit operator acknowledgement at execution time. In a cron-driven automation context for real brokerage activity, this increases the chance of unintended live trades from misconfiguration, compromised inputs, or logic errors.

Missing User Warnings

High

• Confidence: 88% confidence
• Finding: The `monitor` mode calls `bot.trade_engine.run_stop_loss_monitor()`, which may place orders automatically based on stop-loss conditions without a fresh confirmation or explicit live-trading warning in the runner. Because this script is intended for unattended cron execution, an operator may not realize that monitoring mode can trigger real sell orders, making accidental or mis-triggered liquidation more likely.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The generated setup_cron.sh script adds or replaces a user crontab entry automatically, without any confirmation prompt or explicit opt-in at execution time. Because this skill is for automated trading, persistence is more sensitive than usual: it can cause recurring broker-connected actions and repeated execution even after the user forgets it was enabled.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: Writing API credential values into a config file automatically and without strong warning encourages insecure secret storage and may cause users to unknowingly retain sensitive material in local files, backups, or repositories. In a trading integration context, mishandled broker/API credentials can lead to account misuse, data exposure, or unauthorized trading activity.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The interactive setup collects broker and Telegram credentials and writes them directly to config/secrets.json in plaintext, without setting restrictive filesystem permissions or clearly warning the user about local secret exposure. On multi-user systems, shared workstations, backups, or if the file is accidentally included in artifacts, these credentials could be recovered and abused to access brokerage or notification accounts.

VirusTotal

57/57 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.