TAAPI CLI

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:22 AM UTC
• Version: 1.0.1

Overview

The skill is mostly coherent for TAAPI market-data access, but its direct request path can expose the user's TAAPI secret in command arguments and error logs.

Review this skill before installing if you will use real TAAPI credentials, especially in CI, shared machines, or logged agent runs. Prefer the bulk or multi POST flows where practical, use a revocable TAAPI secret, avoid unofficial base URLs unless deliberate, and rotate the secret if failed direct-command logs may have been retained.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/taapi-agent.sh:143

Finding

TAAPI Secret Exposed Through URL Arguments and Error Messages

Content

View full analysis

Vulnerability Details

File Location: scripts/taapi-agent.sh, lines 143, 154, 168–177, and 225–227
Vulnerability Type: Credential disclosure through query strings, process arguments, and diagnostic output
Risk Level: Medium

Vulnerable Code

bash

if [[ "$status" == "429" || "$status" =~ ^5[0-9][0-9]$ ]]; then
  if (( attempt <= retries )); then
    sleep "$attempt"
    continue
  fi
fi
echo "$body" >&2
die "http status $status from $url"

bash

cat "$tmpfile" >&2 || true
die "curl failed for $url"

bash

build_direct_url() {
  local indicator="$1"
  shift
  local q="secret=$(urlencode "$SECRET")"
  local kv
  for kv in "$@"; do
    local k="${kv%%=*}"
    local v="${kv#*=}"
    q+="&$(urlencode "$k")=$(urlencode "$v")"
  done
  printf '%s/%s?%s' "$BASE_URL" "$indicator" "$q"
}

bash

local url body
url="$(build_direct_url "$indicator" "${query[@]}")"
body="$(http_with_retries "GET" "$url" "" "$retries" "$timeout")"
render_output "$body" "$output_mode"

Technical Analysis

The direct command constructs a URL whose query string contains the URL-encoded TAAPI_SECRET. That complete URL is then passed to curl as a command-line argument. Depending on the operating system and process-monitoring configuration, another local user or monitoring agent may be able to observe it through process listings.

The same complete URL is interpolated into error messages after an HTTP failure or terminal curl failure. Consequently, the secret can be written to stderr and retained in CI logs, terminal recordings, centralized logging platforms, or support diagnostics.

URL encoding does not protect the credential because it is reversible transport encoding rather than encryption or redaction. This behavior also weakens the documentation’s recommendation to use TAAPI_SECRET instead of --secret to reduce process-list exposure: although the initial script arguments omit the secret, the child curl command receives a URL that con ...[truncated 1589 chars]

Remediation

View remediation

Remediation Suggestions

1. Redact credentials from all diagnostics.

   • Do not print the complete request URL.
   • Report only the HTTP method, trusted host, endpoint path, and status.
   • Add a centralized redaction function that removes secret query parameters before any URL reaches logs.

2. Avoid placing the secret in observable process arguments.

   • If TAAPI supports it, use an authorization header or request body instead of query-string authentication.
   • If the direct endpoint strictly requires a query parameter, pass sensitive curl configuration through a protected file descriptor or stdin rather than including the complete URL in curl arguments.
   • Ensure temporary credential-bearing files are created with restrictive permissions and deleted reliably if such files are unavoidable.

3. Separate safe diagnostic context from transport data.

   • Pass a sanitized endpoint label to http_with_retries for error reporting rather than reusing the request URL.
   • Never include credentials in exceptions, retry messages, tracing output, or shell debugging.

4. Add regression tests.

   • Invoke the CLI with a distinctive dummy secret and a controlled failing endpoint.
   • Capture stdout and stderr and assert that neither contains the raw nor URL-encoded secret.
   • Where feasible, inspect spawned command arguments in a test harness and verify the credential is absent.

5. Update the documentation.

   • Clarify that environment-variable input alone does not prevent disclosure if the implementation later places the credential in a child process’s arguments.
   • Recommend credential rotation if a failure log from the affected implementation may have been retained.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill explicitly documents and encourages shell execution and live network access via curl, but it does not declare any tool scope such as permissions or allowed-tools. That mismatch weakens sandboxing and review controls because an agent may invoke shell and external network actions without an explicit policy boundary, increasing the chance of unintended secret exposure or outbound requests.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/taapi-agent.sh (reported line 126)May include surrounding context.

sh

attempt=$((attempt + 1))
    if [[ -n "$data" ]]; then
      set +e
      body="$(curl -sS --connect-timeout 10 --max-time "$timeout" \
        -X "$method" \
        -H "Content-Type: application/json" \
        -w $'\n%{http_code}' \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The direct request path includes the TAAPI secret in the URL query string (secret=...). Secrets in URLs are commonly exposed through shell history, process lists, proxy/server logs, browser or tooling telemetry, and error messages, making them easier to leak than secrets sent in headers or request bodies. In this trading-data skill, the issue is more dangerous because API keys may be valuable and the tool is explicitly designed for automated agent workflows where logging and tracing are common.

Content

No source excerpt is available for this finding.