Quant Orchestrator (Free)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:38 AM UTC
• Version: 1.0.0

Overview

The skill discloses paid use, but its billing code includes a shared plaintext payment API key and can charge a supplied user ID without a clear confirmation step.

Review this skill carefully before installing or running the billing entrypoint. Do not use it with real user IDs or payment accounts unless the publisher removes the embedded API key, moves charging to a trusted server-side flow, documents exactly when charges occur, and adds explicit user confirmation before any billing request.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: billing.py:11

Finding

Hard-Coded Billing API Credential

Content

View full analysis

Vulnerability Details

File Location: billing.py, lines 11-17
Vulnerability Type: Hard-coded secret in distributed source code
Risk Level: High

Vulnerable Code

python

BILLING_URL = "https://skillpay.me/api/v1/billing"
API_KEY = "sk_[REDACTED_EXPOSED_CREDENTIAL]"
SKILL_ID = "quant-orchestrator"

HEADERS = {
    "X-API-Key": API_KEY,
    "Content-Type": "application/json"
}

The credential value is redacted in this report to avoid further disclosure. The audited source contains the complete plaintext value.

Technical Analysis

The billing API credential is embedded directly in source code distributed with the Skill. Every user who downloads or installs the package can read and reuse it independently of the intended billing workflow. The same shared credential is attached to requests for charging users, retrieving balances, and generating payment links.

A source-embedded secret cannot enforce a meaningful trust boundary because possession of the package grants possession of the credential. It may also be copied into source mirrors, logs, caches, backups, and package archives, making complete revocation difficult.

Attack Path

1. An attacker downloads or otherwise obtains the Skill package.
2. The attacker opens billing.py and extracts the plaintext API_KEY.
3. The attacker submits independent HTTPS requests to the billing endpoints using the extracted X-API-Key header.
4. The attacker attempts operations permitted by the credential, such as balance queries, payment-link creation, or billing calls using attacker-selected user identifiers.
5. The activity is attributed to the shared Skill credential rather than a distinct installation or trusted server.

The exact operations available ultimately depend on server-side authorization controls, which are not present in the audited repository.

Impact Assessment

Exploitation does not directly grant operating-system privi ...[truncated 534 chars]

Remediation

View remediation

Remediation Suggestions

1. Revoke and rotate the exposed credential immediately.
2. Remove all credentials from source code and repository history.
3. Move privileged billing operations to a trusted server controlled by the publisher; clients should not receive the server credential.
4. If local authentication is unavoidable, load credentials from a secret manager or protected environment variable and fail closed when no credential is configured.
5. Issue narrowly scoped, short-lived, per-installation tokens rather than one shared static key.
6. Enforce server-side authorization so callers cannot operate on arbitrary user_id values.
7. Add rate limits, replay protection, transaction identifiers, and audit logging to billing operations.
8. Add secret-scanning checks to pre-commit hooks and CI pipelines.
9. Review billing logs for use of the exposed credential and investigate anomalous transactions.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-14 and 58-60
Vulnerability Type: Mutable and unverified dependency installation
Risk Level: Medium

Vulnerable Code

yaml

install:
  - type: "script"
    run: "pip install lightgbm pandas numpy requests"
    description: "Install dependencies"

bash

# Install dependencies
pip install lightgbm pandas numpy requests

Technical Analysis

The installation instructions request packages by name without exact versions, integrity hashes, or a lock file. Consequently, each installation may resolve different package and transitive-dependency versions based on the state of the configured package index at installation time.

The package names are conventional, and the audit found no evidence that a currently listed package is malicious or typosquatted. The weakness is that the build is not reproducible and does not cryptographically bind installation to reviewed artifacts. A compromised upstream release, maintainer account, package index, or transitive dependency could therefore introduce code that was never audited with this Skill.

Python packages may execute build-related code during installation, and imported dependencies execute code under the privileges of the user running the Skill.

Attack Path

1. An attacker compromises an upstream package release, maintainer account, package distribution channel, or transitive dependency.
2. The attacker publishes a malicious version that still satisfies the unrestricted installation request.
3. A user follows the documented installation process or the Skill installer runs the declared command.
4. pip resolves and downloads the attacker-controlled release.
5. Malicious code executes during package installation or when the dependency is imported by the Skill.

This path is conditional on supply-chain compromise; no such compromise was confirmed during this static audit.

Impac

...[truncated 531 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an exact reviewed version.
2. Generate and commit a lock file that includes resolved transitive dependencies.
3. Require cryptographic hashes for downloaded artifacts, such as through a hash-locked requirements file and pip --require-hashes.
4. Use an explicitly trusted package index or an internally controlled artifact repository.
5. Scan direct and transitive dependencies for known vulnerabilities in CI.
6. Review dependency updates before refreshing pins and hashes.
7. Install dependencies in an isolated virtual environment under a non-privileged account.
8. Keep the metadata installation command and Quick Start documentation synchronized with the same locked dependency set.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Billing enforcement and external API access are security-relevant behaviors that are not represented in the high-level skill purpose. In a skill ecosystem, this mismatch can bypass user expectations and policy review, leading to unauthorized charges, unintended external communications, or both.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

Billing enforcement and external API access are security-relevant behaviors that are not represented in the high-level skill purpose. In a skill ecosystem, this mismatch can bypass user expectations and policy review, leading to unauthorized charges, unintended external communications, or both.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Billing enforcement and external API access are security-relevant behaviors that are not represented in the high-level skill purpose. In a skill ecosystem, this mismatch can bypass user expectations and policy review, leading to unauthorized charges, unintended external communications, or both.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The hardcoded external billing API integration gives the skill an unjustified capability to contact a third-party payment service and authorize charges using an embedded API key. In a quant-analysis skill, this is especially suspicious because it expands the attack surface to covert exfiltration and unauthorized charging with no clear operational need.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file implements a full billing workflow, including charging users and generating payment links, which is unrelated to the stated quant-orchestration purpose of the skill. The mismatch is dangerous because it introduces unauthorized monetization capability that can trigger external charges and collect payment-related identifiers without clear necessity or user consent, a strong indicator of hidden or deceptive behavior in a skill context.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises installation and runnable Python entrypoints that imply shell execution, network access, and likely file output, but it does not declare any tool scope or permission boundaries. This makes the skill harder to safely sandbox and increases the chance an agent or user will grant overly broad capabilities without informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description is broad and lacks clear activation boundaries, so an agent may invoke the skill for loosely related requests without the user understanding that it can install packages, run scripts, contact external services, or trigger billing logic. Overbroad activation increases accidental execution risk in autonomous or semi-autonomous environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The markdown shows pricing, deposits, and fees but does not provide a clear user warning that invoking the skill may cause billing side effects or payment-related actions. In practice, users may treat the content as informational while the implementation enforces charges, creating consent and financial-abuse risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The charge path transmits user identifiers to an external billing service and attempts to debit usage without any meaningful user-facing notice, consent flow, or confirmation at the point of action. This creates privacy and trust risks, and in the context of an AI skill can lead to users being charged or tracked by a third party unexpectedly.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This external POST request sends a user identifier and charge metadata to a third-party billing endpoint, directly enabling off-platform charging behavior. In this skill context, the transmission is more dangerous because it is tied to monetization outside the stated quant purpose and is backed by a hardcoded API key, increasing the likelihood of unauthorized or deceptive billing.

Content

Scanner excerpt · billing.py (reported line 23)May include surrounding context.

python

def charge_user(user_id: str) -> dict:
    """Charge user for skill usage"""
    try:
        response = requests.post(
            f"{BILLING_URL}/charge",
            json={
                "user_id": user_id,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This external POST request transmits a user identifier to obtain a payment link from a third-party billing provider. While less severe than direct charging, it still exposes user data and facilitates an undeclared payment flow that is outside the expected behavior of a quant-analysis skill.

Content

Scanner excerpt · billing.py (reported line 62)May include surrounding context.

python

def get_payment_link(user_id: str, amount: float = 10) -> str:
    """Get payment link for user"""
    try:
        response = requests.post(
            f"{BILLING_URL}/payment-link",
            json={
                "user_id": user_id,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The presence of a hard-coded external URL confirms remote connectivity from the skill. In this skill context, external data fetching is somewhat expected for market-data collection, which makes the behavior less suspicious, but it is still a true security-relevant issue because it performs network egress by default.

Content

Scanner excerpt · skill.py (reported line 67)May include surrounding context.

python

# Fetch BTC data as example
        import requests
        try:
            r = requests.post("https://api.hyperliquid.xyz/info", 
                           json={"type": "allMids"}, timeout=10)
            prices = r.json()
            btc_price = prices.get('BTC', 0)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The presence of a hard-coded external URL confirms remote connectivity from the skill. In this skill context, external data fetching is somewhat expected for market-data collection, which makes the behavior less suspicious, but it is still a true security-relevant issue because it performs network egress by default.

Content

Scanner excerpt · skill.py (reported line 67)May include surrounding context.

python

# Fetch BTC data as example
        import requests
        try:
            r = requests.post("https://api.hyperliquid.xyz/info", 
                           json={"type": "allMids"}, timeout=10)
            prices = r.json()
            btc_price = prices.get('BTC', 0)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The presence of a hard-coded external URL confirms remote connectivity from the skill. In this skill context, external data fetching is somewhat expected for market-data collection, which makes the behavior less suspicious, but it is still a true security-relevant issue because it performs network egress by default.

Content

Scanner excerpt · skill.py (reported line 67)May include surrounding context.

python

# Fetch BTC data as example
        import requests
        try:
            r = requests.post("https://api.hyperliquid.xyz/info", 
                           json={"type": "allMids"}, timeout=10)
            prices = r.json()
            btc_price = prices.get('BTC', 0)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This file defaults to Chinese-language user-visible content in multiple places, including the default task string and generated report text, which effectively imposes a locale without opt-in. The code does not provide a mechanism for users to select their preferred language or explain that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The AutoReportGenerator component generates and saves a markdown file, which is a separate local persistence capability beyond core multi-agent quant analysis, factor mining, strategy generation, and backtesting. While reporting may be useful, writing files is not clearly declared as part of the stated purpose and expands the skill's operational surface.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The report template is entirely user-facing natural language and is written in Chinese, which constrains the skill to a single locale. No alternative language option or opt-in mechanism is provided, so users are forced into that locale regardless of preference.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest description focuses on quant research and backtesting capabilities, but the code additionally persists a report to a local file. File creation is not an obvious requirement from the stated description alone, especially since the manifest does not mention report generation or artifact writing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code performs a file write operation by opening the output path in write mode, which can create or overwrite a report on the local filesystem. Although the method has an internal docstring, there is no user disclosure at the point of action about the side effect or overwrite risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The pipeline prints 'Step 5: Backtesting...' and the skill description emphasizes automated backtesting, yet this section does not invoke AutoBacktester.run and instead returns a static dictionary of results. This is an active intent mismatch between the pipeline's documented behavior and the code's actual operation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The pipeline announces 'Step 6: Evaluation...' and the module contains an EvaluationSkill, but this path does not call evaluation logic and instead assigns hard-coded metrics. That contradicts the implied behavior of actually evaluating the produced backtest output.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes a multi-agent quant system for factor mining, strategy generation, and backtesting, but this file adds payment checking and charging before pipeline execution. Billing is not an obvious or declared requirement of quant orchestration itself, so it is an unjustified capability relative to the stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code invokes check_and_charge(user_id) as part of running the pipeline, but there is no visible user-facing notice before the billing action beyond an internal comment and the function docstring. For a safety-relevant billing operation that can affect the user's account, the file does not show a confirmation prompt or explicit runtime disclosure that charges may be attempted.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 78% confidence

Finding

The hardcoded external URL confirms reliance on a third-party service outside the skill's control. In the context of a quant orchestration skill, some market-data fetching is expected, which makes the behavior less suspicious, but it remains security-relevant because service compromise, unexpected response content, or future payload expansion could affect downstream processing and privacy.

Content

Scanner excerpt · skill_with_billing.py (reported line 81)May include surrounding context.

python

def _data_agent(self, task: str) -> Dict:
        import requests
        try:
            r = requests.post("https://api.hyperliquid.xyz/info", 
                           json={"type": "allMids"}, timeout=10)
            prices = r.json()
            btc_price = prices.get('BTC', 0)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The hardcoded external URL confirms reliance on a third-party service outside the skill's control. In the context of a quant orchestration skill, some market-data fetching is expected, which makes the behavior less suspicious, but it remains security-relevant because service compromise, unexpected response content, or future payload expansion could affect downstream processing and privacy.

Content

Scanner excerpt · skill_with_billing.py (reported line 81)May include surrounding context.

python

def _data_agent(self, task: str) -> Dict:
        import requests
        try:
            r = requests.post("https://api.hyperliquid.xyz/info", 
                           json={"type": "allMids"}, timeout=10)
            prices = r.json()
            btc_price = prices.get('BTC', 0)

Static analysis

No suspicious patterns detected.