crypto-trader

• Outcome: Review
• Latest audit: May 28, 2026 · 12:37 PM UTC
• Version: 1.0.0

Overview

This is a disclosed crypto trading skill, but it can make or cancel live financial orders through broad agent-triggered commands without an enforceable confirmation gate in the runtime code.

Review carefully before installing. Keep CRYPTO_DEMO=true unless you intentionally want live trading, use exchange API keys with withdrawal permissions disabled, start only small strategies after an explicit confirmation, and be aware that emergency-stop can cancel all open orders across configured exchanges.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tainted flow: '_STATE_PATH' from os.environ.get (line 23, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

def _save_state(self) -> None:
        _STATE_PATH.parent.mkdir(parents=True, exist_ok=True)
        with open(_STATE_PATH, "w", encoding="utf-8") as fh:
            json.dump(self._state, fh, indent=2, default=str)

    # ------------------------------------------------------------------

• Confidence: 93% confidence
• Finding: The daemon writes state to a path fully controllable via the CRYPTO_MONITOR_STATE_PATH environment variable without validation or safe-open protections. If this process runs with elevated privileges or in a shared environment, an attacker who can influence the environment can redirect writes to arbitrary files or symlink targets, causing file overwrite, corruption, or clobbering of sensitive paths.

Tainted flow: '_PID_PATH' from os.environ.get (line 27, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

@staticmethod
    def _write_pid() -> None:
        _PID_PATH.parent.mkdir(parents=True, exist_ok=True)
        with open(_PID_PATH, "w") as fh:
            fh.write(str(os.getpid()))

    @staticmethod

• Confidence: 95% confidence
• Finding: The PID file path is taken from CRYPTO_MONITOR_PID_PATH and written without validation, enabling arbitrary file write if an attacker can control the process environment. PID files are especially risky because the content is predictable and the code also later unlinks the path, which can be abused for file clobbering or deletion of attacker-chosen targets in unsafe deployment setups.

Tainted flow: 'webhook_url' from os.environ.get (line 218, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

try:
            import requests
            payload = {"content": message}
            resp = requests.post(webhook_url, json=payload, timeout=10)
            if resp.status_code in (200, 204):
                return True
            logger.error("Discord webhook error: %d %s", resp.status_code, resp.text)

• Confidence: 89% confidence
• Finding: The Discord webhook URL is read directly from an environment variable and used as the full outbound destination for requests.post. If an attacker can influence environment configuration, alerts containing trading activity, errors, and portfolio data could be exfiltrated to an attacker-controlled endpoint, making this an SSRF/exfiltration sink rather than just routine notification behavior.

Tainted flow: '_STATE_PATH' from os.environ.get (line 27, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

def _save_state(self) -> None:
        _STATE_PATH.parent.mkdir(parents=True, exist_ok=True)
        with open(_STATE_PATH, "w", encoding="utf-8") as fh:
            json.dump(self._state, fh, indent=2, default=str)

    def _reset_daily_if_needed(self) -> None:

• Confidence: 90% confidence
• Finding: The code trusts the CRYPTO_RISK_STATE_PATH environment variable and uses it directly for directory creation and file writes. If an attacker can influence the process environment, they can redirect writes to arbitrary filesystem locations, potentially overwriting application files, writing into sensitive paths, or abusing symlink targets; because this is a trading skill that persists operational state, path tampering can also disable or manipulate risk controls.

Tainted flow: '_STATE_PATH' from os.environ.get (line 27, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

"updated_at": datetime.now(timezone.utc).isoformat(),
        }
        _STATE_PATH.parent.mkdir(parents=True, exist_ok=True)
        with open(_STATE_PATH, "w", encoding="utf-8") as fh:
            json.dump(state, fh, indent=2, default=str)

• Confidence: 89% confidence
• Finding: The state file path is taken directly from the CRYPTO_STRATEGY_STATE_PATH environment variable and then written without validation. If an attacker can influence the process environment or startup configuration, they can redirect writes to an arbitrary filesystem location, causing file clobbering, overwriting application data, or writing sensitive strategy metadata to an unintended path; in a trading skill, this is more concerning because the persisted state may expose trading activity and strategy parameters.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The file advertises copy-trading capability but the core monitoring functions are stub implementations that always return no signals. In a trading skill, this is a security-relevant integrity issue because operators may rely on a strategy they believe is actively monitoring and mirroring trades when it is in fact non-functional, leading to unsafe automation assumptions, missed market actions, and misleading risk posture.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The invocation guidance is broad enough to match ordinary questions about crypto trading, portfolio management, or market analysis, which can cause the skill to activate in situations where the user only wanted information. In a skill that can access balances, exchange accounts, and potentially execute strategies, overbroad triggering increases the risk of unintended high-impact actions or disclosure of sensitive financial data.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The emergency-stop examples include generic phrases like 'Emergency!' and 'Stop everything!', which overlap with normal conversational language and could be triggered accidentally or by ambiguous user input. In this context, the action cancels all open orders across all exchanges, stops all strategies, and flips a persistent kill switch, so a false trigger can cause immediate financial disruption and operational downtime.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The cancellation methods directly perform destructive trading actions without any built-in confirmation, policy gate, or safety interlock. In an agent skill context, this increases the chance that a prompt injection, agent misinterpretation, or accidental invocation could cancel legitimate orders and disrupt active trading strategies.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The emergency_stop path immediately stops all strategies, cancels all orders on all configured exchanges, and activates a kill switch with no confirmation, dry-run, or explicit safeguard. In a live trading context this can cause immediate financial disruption, forced liquidation of strategy state, or unintended interference if triggered accidentally or by an upstream agent misunderstanding the request.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The start_strategy and stop_strategy operations can alter live market behavior by initiating or halting automated trading, yet they accept direct execution without any user-facing warning, environment guard, or confirmation. Because this skill explicitly supports LIVE trading across multiple exchanges, accidental invocation or prompt/agent misuse could lead to unwanted trades, missed exits, or disrupted portfolio management.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This strategy automatically emits market buy and sell orders based on portfolio drift, with no explicit confirmation gate, user warning, or dry-run safeguard at the point of action generation. In a live crypto-trading skill, these orders can cause immediate and irreversible execution, especially during volatile markets or if configuration, balances, or pricing data are wrong.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The strategy generates executable buy and sell signals for a live trading system without any explicit confirmation, warning, or paper-trading guard at the strategy layer. In the context of a crypto auto-trading skill, this increases the chance that a user or upstream agent will trigger real market activity and financial loss without clear user awareness, especially because the code emits market and limit orders directly based on live data.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.