Security audit

eToro Apps

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent eToro API reference, but it exposes live trading and account-changing actions without clear safeguards for user confirmation or credential handling.

Review this before installing if you intend to connect a real eToro account. Prefer read-only or demo credentials unless you specifically need live trading, and require the agent to show the exact order, position, watchlist, or post and get explicit confirmation before any trade, cancellation, deletion, close, or public feed action. Treat all tokens, API keys, user keys, PKCE values, and client secrets as sensitive.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: This endpoint allows deletion of demo market open orders by orderId, which is a destructive operation if an agent is induced to act on untrusted or mistaken identifiers. While demo-only reduces financial severity, it still enables unauthorized or unintended state changes and can normalize unsafe automation patterns that also exist for real trading.
Content: Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.
md
Endpoints: - `DELETE /trading/execution/demo/market-open-orders/{orderId}` - `DELETE /trading/execution/market-open-orders/{orderId}` ### Market Close Orders

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: This endpoint cancels real market open orders by orderId, making it a high-risk destructive capability if the agent accepts untrusted parameters or acts without confirmation. In a trading skill, erroneous or maliciously influenced cancellation can directly alter financial outcomes, interfere with execution strategy, and cause losses.
Content: Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.
md
Endpoints: - `DELETE /trading/execution/demo/market-open-orders/{orderId}` - `DELETE /trading/execution/market-open-orders/{orderId}` ### Market Close Orders

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Deleting a demo market close order is a destructive state-changing action that can be triggered through a single identifier. Although limited to demo, it still represents unsafe agent behavior if raw IDs are accepted without confirmation or ownership verification.
Content: Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.
md
- `POST /trading/execution/demo/market-close-orders/positions/{positionId}` - `POST /trading/execution/market-close-orders/positions/{positionId}` - `DELETE /trading/execution/demo/market-close-orders/{orderId}` - `DELETE /trading/execution/market-close-orders/{orderId}` Body (JSON):

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: Deleting a real market close order can materially affect risk management and portfolio outcomes, especially if the close order was intended to exit exposure. If an agent can be manipulated into cancelling such orders using untrusted orderId input, the user may remain exposed to market risk and suffer losses.
Content: Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.
md
- `POST /trading/execution/demo/market-close-orders/positions/{positionId}` - `POST /trading/execution/market-close-orders/positions/{positionId}` - `DELETE /trading/execution/demo/market-close-orders/{orderId}` - `DELETE /trading/execution/market-close-orders/{orderId}` Body (JSON):

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 89% confidence
Finding: This demo limit-order deletion endpoint is destructive and susceptible to misuse if the skill does not constrain or validate orderId inputs. The demo environment lowers direct financial harm, but it still exposes a dangerous action surface that can train unsafe patterns and disrupt testing workflows.
Content: Scanner excerpt · SKILL.md (reported line 268)May include surrounding context.
md
Endpoints: - `POST /trading/execution/demo/limit-orders` - `DELETE /trading/execution/demo/limit-orders/{orderId}` - `POST /trading/execution/limit-orders` - `DELETE /trading/execution/limit-orders/{orderId}`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: This endpoint deletes real limit orders by orderId, a destructive trading action that can be abused if an agent accepts attacker-influenced or mistaken identifiers. Cancelling pending orders can directly change execution outcomes and lead to missed entries, unmanaged exposure, or financial loss.
Content: Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.
md
- `POST /trading/execution/demo/limit-orders` - `DELETE /trading/execution/demo/limit-orders/{orderId}` - `POST /trading/execution/limit-orders` - `DELETE /trading/execution/limit-orders/{orderId}` Body (PascalCase, JSON):

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 83% confidence
Finding: Deleting a watchlist is a destructive action, though lower impact than trading endpoints because it affects user configuration rather than direct funds. In an agent setting, an untrusted or mistaken watchlistId could still cause loss of user data or unwanted account changes.
Content: Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.
md
Query: `name` (required), `type`, `dynamicQuery` (optional). (Uses query params, not a JSON body.) - `PUT /watchlists/{watchlistId}` Query: `newName` (required). (Uses query params, not a JSON body.) - `DELETE /watchlists/{watchlistId}` **Watchlist items (body schema)**

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 82% confidence
Finding: This endpoint deletes watchlist items and is therefore a state-changing action vulnerable to parameter misuse if item sets are accepted without validation. The impact is limited to account organization, but accidental or induced deletions can still harm user experience and trust.
Content: Scanner excerpt · SKILL.md (reported line 314)May include surrounding context.
md
- `POST /watchlists/{watchlistId}/items` - `PUT /watchlists/{watchlistId}/items` - `DELETE /watchlists/{watchlistId}/items` Example body:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly enables real trade execution but does not require explicit user confirmation, warn about financial risk, or distinguish safe read-only operations from destructive ones. In an agent context, this increases the chance of unintended live trades or position closures triggered from ambiguous prompts or automation mistakes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The authentication section instructs use of bearer tokens, user keys, and a client-secret-based token exchange without warning that these credentials are highly sensitive and must not be logged, echoed, stored insecurely, or requested unnecessarily. In an agent/tooling ecosystem, omission of credential-handling guidance materially increases the risk of secret exposure and account compromise.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
Example:

bash
curl -X GET "https://public-api.etoro.com/api/v1/watchlists" \ -H "x-request-id: <UUID>" \ -H "Authorization: Bearer <access_token>"

Static analysis

No suspicious patterns detected.