pionex-bot

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:19 AM UTC
• Version: 1.0.0

Overview

The skill is mostly explicit about managing Pionex trading bots, but it combines high-impact trading authority with an unpinned executable dependency and a signal-publishing capability that is not disclosed in the frontmatter description.

Review this skill carefully before installing. Use a dedicated Pionex API key with only the required bot permissions, avoid withdrawal or unrelated account permissions, prefer dry runs first, and confirm every live trading or signal-publishing action. The publisher should pin the npm package version and disclose signal publishing in the manifest description.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Executable npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–19
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Complete Code Snippet:

yaml

agent:
  requires:
    bins: ["pionex-trade-cli"]
  install:
    - id: npm
      kind: node
      package: "@pionex/pionex-ai-kit"
      bins: ["pionex-trade-cli", "pionex-ai-kit"]

Technical Analysis

The Skill installs and executes @pionex/pionex-ai-kit without pinning an exact package version or verifying an integrity hash. Consequently, the code installed at deployment time may differ from the version reviewed when the Skill was published.

The dependency implementation is not included in the audited project. Its credential handling, transaction construction, network destinations, and logging behavior therefore cannot be verified from the available source. Because the CLI is intended to operate with Pionex API credentials and bot-trading permissions, a compromised or unexpectedly modified package version would execute in a security-sensitive context.

The package installation is necessary to provide the Skill's declared trading functionality, but accepting an unrestricted version is not necessary and weakens supply-chain security.

Attack Path

1. An attacker compromises the npm publisher account, package registry path, or release process for @pionex/pionex-ai-kit.
2. The attacker publishes a malicious package version under the expected package name.
3. A user or agent installs the Skill dependency without an exact version or integrity constraint.
4. npm resolves and installs the attacker-controlled release.
5. The agent invokes pionex-trade-cli for a legitimate bot-management operation.
6. The malicious CLI executes with the user's local privileges and access to Pionex credentials.
7. It can steal credentials, transmit account or trading information to an attacker-controlled destination, modify tr ...[truncated 1065 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @pionex/pionex-ai-kit to an exact reviewed version rather than allowing unrestricted resolution.
2. Use a lockfile and verify the package archive with an expected integrity hash or cryptographic signature.
3. Restrict installation to the official npm registry and disable unexpected registry overrides where practical.
4. Review the resolved package and its transitive dependencies, particularly credential loading, logging, subprocess execution, and network-request code.
5. Document the expected Pionex API endpoints and reject connections to unapproved destinations through egress controls where feasible.
6. Run the CLI under a dedicated, minimally privileged operating-system account or sandbox.
7. Use a dedicated Pionex API key with only the bot permissions required for the requested operation. Do not grant withdrawal or unrelated account permissions.
8. Rotate credentials promptly if dependency compromise is suspected, and retain audit logs for package installation and trading operations.
9. Require user confirmation immediately before consequential write operations, even when a prior dry run succeeded.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill metadata and description frame this capability as bot order management, but the body also enables publishing trading signals to the Pionex signal platform. That mismatch can cause an agent or reviewer to grant this skill in contexts where signal emission was not expected, expanding effective privileges and enabling unintended external actions under valid API credentials.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documented command set includes bot signal listener, which performs a write action that pushes trading signals to an external platform, yet this behavior is outside the skill's stated bot-order management purpose. In an agentic setting, this kind of hidden or weakly disclosed side capability is dangerous because it can be invoked with trusted credentials to trigger downstream trading workflows or market-facing automation the user did not intend.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.