pionex-trade

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:35 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Pionex spot-trading helper, but users should treat the external CLI install and trading API credentials carefully.

Install only if you trust the Pionex npm package source. Use a dedicated Pionex API key limited to the needed spot-trading permissions, disable withdrawals, consider IP allowlisting, and confirm dry-runs before any real order or cancellation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Globally Installed Executable Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–18 and 25–29
Vulnerability Type: Unpinned third-party executable dependency installed globally
Risk Level: Medium

Vulnerable Code

yaml

metadata:
  agent:
    requires:
      bins: ["pionex-trade-cli"]
    install:
      - id: npm
        kind: node
        package: "@pionex/pionex-ai-kit"
        bins: ["pionex-trade-cli", "pionex-ai-kit"]
        label: "Install pionex CLI (npm)"

bash

npm install -g @pionex/pionex-ai-kit
pionex-ai-kit onboard

Technical Analysis

The skill instructs users or agents to install the latest available version of @pionex/pionex-ai-kit from npm without specifying an exact version, lockfile, or integrity hash. An npm installation may execute package lifecycle scripts. The -g option also installs the package globally and exposes its command-line binaries system-wide.

The installed package is subsequently used to initialize Pionex API credentials and perform security-sensitive operations, including reading account information, placing orders, and cancelling orders. The project contains only SKILL.md; therefore, the implementation and security properties of the external package cannot be verified from the audited artifact.

This is a supply-chain exposure rather than evidence that the named package is currently malicious. Exploitation would require a compromised publisher account, registry/package compromise, malicious release, or other unsafe change to the externally retrieved dependency.

Attack Path

1. An attacker compromises the npm package, its publisher account, or a future package release.
2. A user follows the skill instructions and runs npm install -g @pionex/pionex-ai-kit.
3. npm retrieves the attacker-controlled release because no reviewed version or integrity value is pinned.
4. Malicious package code or lifecycle scripts execute during installation, potentially with the installing user's privileges.
5. The user run ...[truncated 866 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @pionex/pionex-ai-kit to an exact, reviewed version rather than installing the latest release implicitly.
2. Record and verify package integrity using a lockfile and npm integrity metadata.
3. Prefer a project-local installation over npm install -g to reduce system-wide exposure and make dependency resolution reproducible.
4. Verify the package publisher, registry source, repository, release signatures, and provenance before installation.
5. Review package contents and lifecycle scripts before approving updates. Consider disabling lifecycle scripts with --ignore-scripts when the package supports operation without them.
6. Establish an explicit dependency-update review process instead of automatically accepting new releases.
7. Use a dedicated Pionex API key with only the permissions required for spot trading, with withdrawal permission disabled.
8. Apply IP allowlisting, credential rotation, restrictive file permissions for ~/.pionex/config.toml, and monitoring for unexpected orders or authentication activity.
9. Run the CLI under a dedicated, least-privileged operating-system account or isolated environment where practical.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest says not to use this skill for balance/portfolio, but the command index includes pionex-trade-cli account balance as a supported command and later sections instruct using it in workflows. The text partially narrows this to trade-related checks, but the documented behavior still exceeds the manifest's stated exclusion.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest says this skill should not be used for market data only and routes such usage to pionex-market, but the skill file explicitly instructs use of pionex-trade-cli market symbols. Even though framed as a pre-trade helper, this documents a market-data capability inside a trade-only skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.