Security audit

Signal Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly generates crypto trading signals, but its root-level Python path usage and scheduled execution guidance create review-worthy risk before installation.

Review this skill before installing. It does not appear designed to steal data or place trades, but run it only in a dedicated, unprivileged Python environment, remove or avoid the /root/quant-trading-bot import-path dependency, pin dependencies, and be deliberate about any Discord/Telegram wrapper because alerts can reveal trading activity and channel identifiers.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: signal_generator.py:12
Finding: External Directory Prepending Enables Python Module Shadowing
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: package.json:14
Finding: Unbounded and Unlocked Third-Party Dependency Resolution
Content: View full analysis
=3.7", "pandas": ">=1.0", "numpy": ">=1.0", "ccxt": ">=1.0" }, ``` ### Technical Analysis All declared dependencies use only minimum-version constraints. No maximum versions, exact reviewed versions, lockfile, or package integrity hashes are supplied. An installation can therefore resolve to dependency releases that did not exist when the Skill was reviewed. The Python dependencies are also declared in `package.json` rather than through a standard Python dependency manifest. Depending on the surrounding installation system, these declarations may not be enforced consistently. This does not prove that any currently available dependency is malicious. The security issue is the lack of reproducible and integrity-verified dependency resolution, which leaves future installations exposed to compromised releases, unexpected behavior changes, or incompatible transitive dependencies. ### Attack Path 1. A user or automated environment installs the Skill dependencies using the broad minimum-version constraints. 2. The package resolver selects the latest matching releases rather than a reviewed dependency set. 3. A selected direct or transitive release contains malicious code, has been compromised, or introduces an exploitable regression. 4. The dependency executes code during installation or when imported by `signal_generator.py`. 5. That code receives the privileges and accessible resources of the account running the installation or Skill. Exploitation depends on a compromised, malicious, or vulnerable dependency release being selected; no such release was identified in the audited files. ### Impact Assessment A malicious dependency can obtain arbitrary code execution with the privileges of the installer or runti ...[truncated 454 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 122)May include surrounding context.
Run every 5 minutes:

bash
crontab -e

Add this line:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly integrates with Discord and Telegram, but the description does not prominently warn that running it will automatically transmit trading signals and related activity to third-party services. This creates a real privacy and data-sharing risk because users may enable the skill without understanding that external notification targets can expose strategy usage, symbols, timing, and channel identifiers.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: The skill is designed to automatically generate signals and send them externally without an explicit human approval step. While this is not inherently malicious, autonomous outward actions increase risk because they can continuously leak sensitive operational information, spam external endpoints, or act on misconfiguration at scale once scheduled via cron.
Content: Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.
md
## 📋 Overview This skill generates trading signals based on technical indicators and automatically sends alerts to your configured channels (Discord, Telegram, etc.). ## 🚀 Features

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The top-level documentation states that the skill 'Generates trading signals and sends alerts to Discord/Telegram.' In the actual implementation, there is no Discord or Telegram integration; the code generates signals, prints them to stdout, and saves them to last_signal.json for another component to send later.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file advertises real-time alerts to Discord and Telegram and later instructs users to configure channel/chat targets, but it does not explicitly warn that signal data will be transmitted to external services. For markdown files, omissions around privacy-affecting behavior qualify as missing user warnings.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.