Dex Skill

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:25 AM UTC
• Version: 3.47.1

Overview

This crypto trading skill is mostly purpose-aligned, but it combines automated real-money trading, wallet-key handling, broad agent-routing instructions, and risky runtime behavior that users should review carefully before installing.

Install only if you are comfortable with a third-party trading service receiving strategy code, signals, a persistent client identifier, and potentially wallet-key setup for automated Hyperliquid trading. Use read-only or testnet mode first, avoid broad environment overrides, and do not enable automatic order execution unless you trust the server, dependency chain, and risk controls.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (8)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:12

Finding

Agent routing and response behavior are overridden by mandatory Skill instructions

Content

View full analysis

" --caption "" ``` ### Technical Analysis The Skill declares that it must handle every trading-related request, explicitly prohibits use of an alternative coding agent, directs the agent to prefer execution, mandates predefined response behavior, and requires results to be delivered through an external messaging command. These controls are not necessary to calculate indicators or perform backtests. They alter the agent's routing, response generation, and output-delivery behavior when the Skill is loaded. Because the trigger scope includes broad terms and short numeric replies, unrelated or ambiguous conversation turns can also be captured by the Skill. The instruction set additionally discourages independent analysis of server-produced output and directs the agent to forward generated captions or standard output without modification. This weakens the agent's ability to warn users about misleading, unsafe, or manipulated remote results. ### Attack Path 1. The Skill is loaded into an agent session. 2. A user submits a broadly matching trading request or a short numeric response. 3. The mandatory trigger rules route the request to this Skill and prohibit use of another agent. 4. The Skill directs the agent to execute prescribed external-serve ...[truncated 549 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:46

Finding

Runtime installation of unpinned Python, system, and trading dependencies

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/server_config.py:14

Finding

Arbitrary server override can redirect stable identifiers, credentials, strategy source, and signals

Content

View full analysis

str: value = (server_url or "").strip() or os.getenv( "DEX_QUANT_SERVER_URL", "" ).strip() return value or DEFAULT_SERVER_URL ``` ```python self.server_url = resolve_server_url(server_url).rstrip("/") self.base_url = self.server_url + API_PREFIX self._client = httpx.Client(timeout=30.0) ``` ```python resp = self._client.post( f"{self.base_url}/auth/register", json={"machine_code": device_id}, ) ``` ```python def _headers(self) -> dict: return {"X-Token": self._token} ``` ```python payload = { "name": name, "description": description, "script_content": script_content, "symbol": symbol, "timeframe": timeframe, "direction": direction, "version": version, "tags": tags or [], } resp = self._client.post( f"{self.base_url}/strategies/", json=payload, headers=self._headers(), ) ``` ### Technical Analysis The endpoint can be supplied explicitly or through `DEX_QUANT_SERVER_URL`, but the resolver does not enforce HTTPS, validate a trusted hostname, or bind credentials to an origin. Constructing `QuantAPIClient` automatically initializes `MachineAuth` and performs registration when no cached token exists. Subsequent calls attach the bearer token and can upload complete strategy source, generated signals, optimization parameters, and monitoring configuration. An attacker who controls process environment variables, command-line arguments, or wrapper configuration can therefore redirect all API communication to an attacker-controlled host. A plain HTTP URL would add ...[truncated 919 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/machine_auth.py:84

Finding

Bearer token is stored as plaintext without explicit restrictive permissions or origin binding

Content

View full analysis

None: if _AUTH_FILE.exists(): try: self._config = json.loads(_AUTH_FILE.read_text()) except (json.JSONDecodeError, OSError): self._config = {} def _save_config(self) -> None: _AUTH_FILE.parent.mkdir(parents=True, exist_ok=True) _AUTH_FILE.write_text( json.dumps(self._config, indent=2, ensure_ascii=False) ) ``` ```python self._config["device_id"] = device_id self._config["token"] = data["token"] self._config["max_strategies"] = data["max_strategies"] self._save_config() ``` ### Technical Analysis The API token is a bearer credential saved directly in a project-level JSON file. `Path.write_text()` does not explicitly create the file with mode `0600`, and the implementation does not verify or repair existing permissions. The cache also lacks an issuer or server-origin field. Therefore, changing the endpoint does not invalidate or separate credentials by origin. Project archives, backups, shared workspaces, or overly permissive default umasks may expose the token. ### Attack Path 1. The client registers and writes `.auth.json`. 2. Another local account, workspace process, backup system, or accidentally published project archive obtains the file. 3. The attacker extracts the token. 4. The attacker submits it as the `X-Token` header to service endpoints. 5. The attacker acts with the token's strategy, monitoring, signal, or vault-management permissions. ### Impact Assessment Token theft can permit impersonation of the registered client. The precise server-side scope is not present in the audited repository, but exposed client methods include strategy retrieval, signal queries, monitor ...[truncated 63 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/signal_runtime.py:61

Finding

Untrusted strategy modules are executed locally without sandboxing

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/risk_checker.py:82

Finding

Consecutive-loss protection does not track realized trading losses

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/risk_checker.py:52

Finding

Concurrency control can block position exits and corrupt exposure accounting

Content

View full analysis

= self.rules["max_concurrent"]: return False, ( f"already {open_positions} positions " f"(max {self.rules['max_concurrent']})" ) ``` ```python if action == "buy" and direction == "long": return {"type": "market_buy", "coin": coin, "size": position_size} elif action == "sell" and direction == "long": return {"type": "market_sell", "coin": coin, "size": position_size} elif action == "sell" and direction == "short": return {"type": "market_sell", "coin": coin, "size": position_size} elif action == "buy" and direction == "short": return {"type": "market_buy", "coin": coin, "size": position_size} ``` ```python pos_data = executor.get_positions() open_positions = len(pos_data.get("positions", [])) ``` ```python passed, reason = risk.check(sig, equity, open_positions) if not passed: logger.warning("BLOCKED by risk: {}", reason) continue ``` ```python risk.record_trade(sig, result) open_positions += 1 ``` ### Technical Analysis The concurrency rule is applied before determining whether a signal increases or reduces exposure. Therefore, a closing order can be rejected merely because the account has reached the maximum number of positions. Every successful order increments `open_positions`, including orders intended to close or reduce positions. The initial count also uses the length of the returned position array without filtering zero-size entries. The market-order mapping lacks an explicit reduce-only flag, so an intended exit may increase or reverse exposure if position state differs from expectations. ### Attack Path 1. The account reaches `max_concurrent` active positions. 2. A strategy emits a signal intended to close one of those position ...[truncated 649 chars]

Remediation

View remediation

other

Warning

• Location: scripts/machine_auth.py:32

Finding

Persistent workspace-derived identifier is collected and transmitted automatically

Content

View full analysis

str: ws_id = _extract_workspace_id() return hashlib.sha256(ws_id.encode()).hexdigest()[:32] ``` ```python device_id = self.machine_code resp = self._client.post( f"{self.base_url}/auth/register", json={"machine_code": device_id}, ) ``` ### Technical Analysis The authentication implementation derives a stable service identifier from the OpenClaw workspace path. If the current path does not match, it scans the shared workspace root and selects a directory name. The value is hashed and truncated, but remains deterministic. Hashing a stable identifier provides pseudonymization rather than anonymity. The resulting value supports correlation across repeated use and reinstallations. Registration happens automatically when the API client is initialized and no token is cached. Scanning the shared workspace root may also select an unrelated workspace directory when multiple directories exist, causing identity collision or unintended association. ### Attack Path 1. The API client is instantiated for the first time. 2. The authentication code examines the Skill path or scans the workspace root. 3. It hashes the discovered workspace identifier. 4. The stable hash is sent to the configured server. 5. The server correlates later backtests, strategies, monitoring tasks, or reinstallations with the same workspace identity. ### Impact Assessment The external service gains a persistent identifier for tracking a ...[truncated 278 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (53)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A skill that can place/cancel orders, manage leverage, and retrieve positions/balances crosses from advisory behavior into direct brokerage-like control. In this context the danger is amplified because misuse, prompt confusion, or automation errors can immediately cause financial loss on Hyperliquid accounts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A skill that can place/cancel orders, manage leverage, and retrieve positions/balances crosses from advisory behavior into direct brokerage-like control. In this context the danger is amplified because misuse, prompt confusion, or automation errors can immediately cause financial loss on Hyperliquid accounts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

A skill that can place/cancel orders, manage leverage, and retrieve positions/balances crosses from advisory behavior into direct brokerage-like control. In this context the danger is amplified because misuse, prompt confusion, or automation errors can immediately cause financial loss on Hyperliquid accounts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A skill that can place/cancel orders, manage leverage, and retrieve positions/balances crosses from advisory behavior into direct brokerage-like control. In this context the danger is amplified because misuse, prompt confusion, or automation errors can immediately cause financial loss on Hyperliquid accounts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A skill that can place/cancel orders, manage leverage, and retrieve positions/balances crosses from advisory behavior into direct brokerage-like control. In this context the danger is amplified because misuse, prompt confusion, or automation errors can immediately cause financial loss on Hyperliquid accounts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A skill that can place/cancel orders, manage leverage, and retrieve positions/balances crosses from advisory behavior into direct brokerage-like control. In this context the danger is amplified because misuse, prompt confusion, or automation errors can immediately cause financial loss on Hyperliquid accounts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A skill that can place/cancel orders, manage leverage, and retrieve positions/balances crosses from advisory behavior into direct brokerage-like control. In this context the danger is amplified because misuse, prompt confusion, or automation errors can immediately cause financial loss on Hyperliquid accounts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

A skill that can place/cancel orders, manage leverage, and retrieve positions/balances crosses from advisory behavior into direct brokerage-like control. In this context the danger is amplified because misuse, prompt confusion, or automation errors can immediately cause financial loss on Hyperliquid accounts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

A skill that can place/cancel orders, manage leverage, and retrieve positions/balances crosses from advisory behavior into direct brokerage-like control. In this context the danger is amplified because misuse, prompt confusion, or automation errors can immediately cause financial loss on Hyperliquid accounts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A skill that can place/cancel orders, manage leverage, and retrieve positions/balances crosses from advisory behavior into direct brokerage-like control. In this context the danger is amplified because misuse, prompt confusion, or automation errors can immediately cause financial loss on Hyperliquid accounts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A skill that can place/cancel orders, manage leverage, and retrieve positions/balances crosses from advisory behavior into direct brokerage-like control. In this context the danger is amplified because misuse, prompt confusion, or automation errors can immediately cause financial loss on Hyperliquid accounts.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger phrases are so broad that ordinary words like 'run', 'test', 'monitor', 'recommend', or a standalone number can activate powerful trading workflows. In a skill that can backtest, optimize, deploy monitoring, and potentially move toward live execution, overbroad triggering increases the risk of unintended invocation and unsafe action chaining.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 419)May include surrounding context.

md

| 执行超时 | `run_server_backtest` 内部自动每 5 秒轮询，无需手动处理 |
| Network error / timeout | Retry once, then report |

### Display rules

`print_trades(bt)` prints full trade table — only needed if user asks for more details.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

This file is a full networked API client that performs authenticated HTTP requests to a remote server, but the finding indicates that network capability is not declared in permissions. Undeclared network access breaks least-privilege expectations and is particularly sensitive here because the skill sends strategy code, signals, and operational data to an external service. In a trading/execution skill, hidden remote communication materially increases risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The API client includes wallet private-key vault setup, status, and deletion operations that are outside the stated scope of strategy generation, backtesting, optimization, and monitoring. Handling private-key onboarding introduces a much more sensitive trust boundary and creates a path from analytics tooling into credential custody and potential fund movement. In a crypto trading skill, this context makes the issue more dangerous because users may reasonably assume the tool is only for research/backtesting, not secret management.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The client reads the PROXY_URL environment variable and changes outbound network routing based on ambient environment state, but this capability is not reflected in the declared permissions. In a hosted agent context, undeclared environment access weakens auditability and can silently route market-data traffic through attacker-controlled infrastructure if the runtime environment is poisoned or misconfigured.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description is explicitly in Chinese and later instructions prescribe fixed Chinese response templates, but the skill does not offer the user a language choice. This can violate language or locale policy because it constrains interaction language without documented opt-in or justified regional scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Mandating use of the skill for ANY trading-strategy-related request without exclusions can override safer routing or more specialized review steps. In this context, that broad mandate can funnel ambiguous user input into an automation-heavy trading workflow with minimal friction.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

L239 states that generated strategy scripts are 'never executed locally' and are only uploaded as source for server backtesting, presenting a tightly limited local role. However, the skill later directs the agent to perform local file modifications such as silently refactoring and saving strategy files for optimization (L459-L479), and the preamble installs local dependencies (L52-L59), so the documentation understates actual local-side behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest explicitly promotes real-time trading deployment and execution but provides no warning about financial loss, automated trading risk, or the consequences of live market actions. In a trading skill, this increases the chance that users will move directly from generated strategy code to live execution without informed consent or safety checkpoints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This JSON schema uses Chinese-only natural-language descriptions throughout, including a requirement that all strategy scripts output this standard format. Under the policy, forcing a specific language or locale without user opt-in or clear region-specific justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring, method docstrings, logs, and printed user-facing messages are written in Chinese throughout, indicating the skill operates in a fixed language by default. The file does not provide any user opt-in, locale selection, or documented region-specific justification, which fits the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Installing system and Python packages at runtime is an unjustified capability for this type of client and materially broadens what the skill can do on the host. Beyond reliability issues, it creates unexpected network and environment modification behavior that users and policy systems may not account for. The mismatch between declared purpose and actual capability is itself a security concern.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 90% confidence

Finding

The client attempts to install a system package at runtime via apt-get. Even though the command is hardcoded, invoking a package manager from application code expands the skill’s execution capabilities, mutates the host environment, and can fail unpredictably or be abused in privileged/containerized contexts. In a trading skill that may run on shared or semi-trusted hosts, this is an unjustified and risky behavior.

Content

Scanner excerpt · scripts/api_client.py (reported line 1044)May include surrounding context.

python

import subprocess
        try:
            subprocess.run(
                ["apt-get", "install", "-y", "--no-install-recommends", "fonts-noto-cjk"],
                capture_output=True, timeout=30,
            )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 88% confidence

Finding

The client dynamically installs matplotlib with pip during normal execution. This allows code to modify its own runtime environment and fetch packages over the network, which is inappropriate for a trading API client and increases supply-chain, reproducibility, and environment-tampering risk. In an agent skill context, hidden dependency installation is especially dangerous because it silently broadens permissions and side effects.

Content

Scanner excerpt · scripts/api_client.py (reported line 1098)May include surrounding context.

python

print("  ⏳ 正在安装 matplotlib ...", flush=True)
            import subprocess, sys
            try:
                subprocess.check_call(
                    [sys.executable, "-m", "pip", "install", "-q", "matplotlib"],
                    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
                )