Trading Bot Suite: Complete 8-Guide Collection for Autonomous Trading Systems

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:35 AM UTC
• Version: 1.3.1

Overview

This is a documentation-only trading-bot guide bundle, but it asks for sensitive credentials without explaining or using them.

Review before installing. The package appears to be a guide bundle, but avoid providing signing or API keys unless the publisher explains why they are needed, what permissions they require, and how they are protected. There is no evidence of theft or destructive behavior in the inspected artifact.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:14

Finding

Unnecessary Exposure of Sensitive Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–20
Vulnerability Type: Excessive credential access violating least privilege
Risk Level: Medium

yaml

credentials: [AGENT_SIGNING_KEY, GREENHELIX_API_KEY]
metadata:
  openclaw:
    requires:
      env:
        - AGENT_SIGNING_KEY
        - GREENHELIX_API_KEY
    primaryEnv: AGENT_SIGNING_KEY

Technical Analysis

The skill declares AGENT_SIGNING_KEY and GREENHELIX_API_KEY as required credentials and identifies the signing key as its primary environment credential. However, the package contains only a descriptive Markdown file, is marked executable: false, requires no installation, and includes no implementation that uses either secret.

Requiring sensitive credentials without demonstrated functional need violates the principle of least privilege. If the hosting platform resolves these declarations by making the named environment variables available to the loaded skill or a related execution context, sensitive signing and API credentials could be exposed unnecessarily.

No executable code, transmission endpoint, or credential-exfiltration mechanism is present in the audited package. Therefore, this finding establishes unnecessary credential access rather than confirmed theft or exfiltration.

Attack Path

1. A user installs or loads the skill in a compatible host.
2. The host processes the credential requirements declared in SKILL.md.
3. The user or host supplies AGENT_SIGNING_KEY and GREENHELIX_API_KEY.
4. The credentials become available to the skill context despite the package having no documented or implemented need for them.
5. If untrusted functionality is later added to the package or the credential-bearing context is otherwise compromised, the unnecessarily exposed secrets could be accessed and abused.

This path depends on the host supplying declared credentials to the skill context. The current package itself ...[truncated 638 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the credentials declaration because the current package is non-executable and does not use credentials.
2. Remove metadata.openclaw.requires.env and metadata.openclaw.primaryEnv.
3. If future executable functionality genuinely requires authentication, request only the minimum necessary credential at the point of use.
4. Avoid designating a private signing key as a general-purpose primary environment credential.
5. Document each credential's exact purpose, required permission scope, recipient service, and lifecycle.
6. Use narrowly scoped, revocable credentials rather than long-lived or broadly privileged keys.
7. Ensure the host does not expose secrets to documentation-only or non-executable skills.
8. Add automated manifest validation that rejects unused credential declarations.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep