Security audit

APEX IA Scanner

Security checks across malware telemetry and agentic risk

Overview

This Binance trading scanner is mostly related to its stated purpose, but it bundles under-disclosed runtime installation, local persistence/web API components, and some misleading or fabricated signal paths.

Review this skill before installing. Treat all outputs as informational, avoid using it for automated or leveraged trading, and consider removing or disabling the runtime npm install fallback, mock/random nested scanner, local history writers, and webapp unless you explicitly need them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill advertises network access to Binance and instructs users to configure environment variables, yet the manifest does not declare the permissions implied by those capabilities. Missing permission declarations weaken transparency and consent, making it easier for a skill to access network resources or local configuration unexpectedly and harder for platforms to enforce least privilege.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared behavior is a market scanner, but the analyzed implementation reportedly also runs persistent WebSocket monitoring, writes signal history under the user's home directory, exposes an Express HTTP server, tracks performance continuously, and may even generate mock/random signals instead of real market analysis. This mismatch is dangerous because users may grant trust and access for a narrow trading tool while receiving a broader long-running service with local data persistence and network exposure that increases attack surface and could mislead trading decisions.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill description promises confirmations from Pivot SuperTrend, RSI, volume, and confluence, but the implementation only uses SMA distance and crossover heuristics. This is a deceptive capability mismatch that can cause users to trust signals under false assumptions, especially in a financial decision-support context where missing confirmations materially change risk.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill advertises confirmations using Pivot SuperTrend, RSI, volume, and confluence, but the implementation only evaluates SMA crossover/proximity from price closes. In a trading skill, this is dangerous because users may rely on signals under false assumptions about the strategy's safeguards, materially increasing the chance of bad trading decisions and financial loss.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill is marketed as multi-timeframe, but the code is hard-coded to a single 15m timeframe. This can mislead users into believing signals were validated across multiple time horizons when they were not, weakening trading decisions and trust in the tool.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The startup banner claims the detector is exactly equal to the user's TradingView configuration, yet the code implements materially simpler logic. In financial tooling, such false equivalence can cause overconfidence, improper automation, and financial harm because users may trust outputs as if they were generated by their known strategy.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The code claims confluence from PivotFlow and SuperTrend, but detectSignal only calculates SMA crossover, RSI, volume, and ATR while adding 'PivotFlow' and 'SuperTrend' as hardcoded confirmation labels. In a trading skill, this is dangerous because users may trust alerts as having passed strategy checks that never actually ran, leading to materially riskier trading decisions under false pretenses.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The startup and alert messaging tells users the strategy is 'Pivot Flow + SMA 8/21 + SuperTrend' and that signals are 'validated automatically,' but the implementation does not perform those validations. This creates deceptive operational output in a financial decision-support context, increasing the chance that operators act on unverified signals believing they were fully screened.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The script executes `npm install ws` automatically at runtime via `child_process.execSync`, which performs code-fetching and package lifecycle execution in the user's environment. This creates a supply-chain and arbitrary-code-execution risk if the registry, dependency resolution, or package metadata is compromised, and it is unnecessary for a market scanner whose dependencies should be installed ahead of time.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill advertises Pivot SuperTrend confirmation and broader confluence, but the implemented logic only performs SMA 8/21 crossover checks with RSI, volume, and ATR-derived target calculations. In a trading automation context, this is security-relevant because it can mislead users into trusting signals generated under materially weaker criteria than promised, creating unsafe financial decisions based on false assumptions about strategy validation.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The startup banner explicitly states the scanner uses 'Pivot Flow + SMA 8/21 + SuperTrend' and is based on a TradingView indicator, but the code shown does not implement Pivot Flow or SuperTrend at all. This kind of misrepresentation is dangerous in a financial skill because it can induce operator overconfidence, cause inappropriate trade execution, and conceal the real basis of alerts from users who rely on the printed strategy description.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The skill advertises a professional Binance Futures scanner with multi-timeframe technical confirmation, but the implementation only emits a fixed symbol list with randomized values and hardcoded targets/stops. In a trading context, this is dangerous because users may rely on fabricated market signals as if they were real analysis, leading to financial loss and erosion of trust.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The skill advertises a professional Binance Futures scanner using technical indicators, but the implementation returns fabricated signals with randomized metrics and fixed targets/stops. In a trading context, this is dangerous because users may rely on output they believe is market-derived, causing financial loss from deceptive or non-existent analysis.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: Importing axios and defining a Kline market-data structure creates the appearance of legitimate exchange-backed analysis, but neither is used and the scanner generates synthetic results instead. This mismatch can mislead reviewers and users into trusting fabricated trading signals, increasing the chance of harmful reliance.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The script silently persists trading signal history to a JSON file under the user's home directory without prior disclosure, consent, or path validation. While the data is not highly sensitive by itself, undisclosed local persistence can expose behavioral or trading metadata to other local processes and surprises users with residual data on disk.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Installing a package automatically through a subprocess without explicit consent is dangerous because it silently changes the host environment and may execute untrusted install scripts. In this skill's context, the behavior is especially unjustified: a real-time scanner should not mutate the system or fetch executable code during normal operation.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: realtime-scanner.js:155