T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/ft-deploy.mjs:203- Finding
Unverified Remote Installer Is Downloaded and Executed Automatically
- Content
View full analysis
- Remediation
View remediation
Security audit
Aicoin Freqtrade
Security checks for vulnerabilities and agentic risk
Overview
The skill largely matches its Freqtrade trading-bot purpose, but it needs Review because crafted inputs and host-mode setup can run unintended code in a live trading environment.
Install only if you are comfortable giving this skill authority over a Freqtrade bot and any configured exchange credentials. Use dry-run first, review generated strategy files before deployment, avoid passing untrusted values into actions, do not use host-mode auto-install on macOS without independently installing prerequisites, and do not point AICOIN_BASE_URL at non-AiCoin hosts.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ft-deploy.mjs:572- Finding
Shell Command Injection Through Unvalidated CLI Parameters
- Content
View full analysis
{ if (ENV) { for (const log of ['/workspace/logs/freqtrade.log', '/workspace/logs/freqtrade-error.log']) { if (existsSync(log)) { try { return { mode: 'coinclaw', log_file: log, logs: run(`tail -${lines} ${log}`) }; } catch {} } } return { mode: 'coinclaw', logs: '(no log file found in /workspace/logs)' }; } try { return { mode: 'host', logs: run(`tail -${lines} ${HOST.logFile} 2>/dev/null`) }; } catch { return { mode: 'host', logs: 'No log file found' }; } }, ``` Backtest parameters are also assembled as shell text: ```javascript const timeframe = params.timeframe || '1h'; const timerange = params.timerange || ''; const timerangeArg = timerange ? ` --timerange ${timerange}` : ''; const pairs = params.pairs; const pairsArg = pairs ? ` -p ${(Array.isArray(pairs) ? pairs : [pairs]).join(' ')}` : ''; const proxyEnv = process.env.PROXY_URL || process.env.HTTPS_PROXY || process.env.HTTP_PROXY; const proxyPrefix = proxyEnv ? `env HTTPS_PROXY=${proxyEnv} HTTP_PROXY=${proxyEnv} ` : ''; console.error('Downloading historical data...'); try { run( `${proxyPrefix}${FT_BIN} download-data --config ${CONFIG_PATH} --timeframe ${timeframe}${timerangeArg}${pairsArg} --userdir ${USER_DATA}`, { timeout: 300000 } ); } catch (e) { console.error(`Data download warning: ${e.message}`); } const rawOutput = run( `${proxyPrefix}${FT_BIN} backtesting --config ${CONFIG_PATH} --strategy ${strategy} --strategy-path ${STRAT_DIR} --timeframe ${timeframe}${timerangeArg}${pairsArg} --userdir ${USER_DATA}`, { timeout: 600000 } ); ``` The shared execution helper invokes a she ...[truncated 2005 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ft-deploy.mjs:712- Finding
Generated Strategy Parameters Permit Arbitrary Python Code Injection
- Content
View full analysis
{ let name = params.name; if (!name) throw new Error('name is required. Example: {"name":"MyStrategy","timeframe":"15m","indicators":["rsi","macd"],"aicoin_data":["funding_rate"]}'); name = name.replace(/[^A-Za-z0-9_]/g, ''); if (name && /^[a-z]/.test(name)) name = name[0].toUpperCase() + name.slice(1); if (!/^[A-Z][A-Za-z0-9_]+$/.test(name)) throw new Error('name must be a valid Python class name starting with uppercase (e.g. MyStrategy)'); ensureSdkAndTemplates(); const dest = resolve(STRAT_DIR, `${name}.py`); const tf = params.timeframe || '15m'; const desc = params.description || 'Custom strategy'; const ds = new Set(params.aicoin_data || []); const indicators = params.indicators || null; const entryLogic = params.entry_logic || null; const exitLogic = params.exit_logic || null; const direction = params.direction || 'long'; // ... const code = buildStrategyCode(name, tf, desc, ds, indicators, entryLogic, exitLogic, direction); writeFileSync(dest, code); ``` Those fields are inserted directly into executable Python source: ```javascript L.push(`# ${name} - ${desc}`); // ... L.push(`class ${name}(IStrategy):`); L.push(` INTERFACE_VERSION = 3`); L.push(` timeframe = '${tf}'`); ``` Raw expressions are also embedded: ```javascript if (entryLogic && entryLogic.long) { longC.push(`(${entryLogic.long})`); shortC.push(`(${entryLogic.short || entryLogic.long})`); } ``` ```javascript if (exitLogic && exitLogic.long) { if (doLong) { L.push(` dataframe.loc[`); L.push(` (${exitLogic.long}),`); L.push(` 'exit_long'] = 1`); } if (do ...[truncated 2041 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
lib/aicoin_data.py:103- Finding
Configurable AiCoin Base URL Can Receive Signed Authentication Headers
- Content
View full analysis
dict: nonce = '%016x' % random.getrandbits(64) ts = str(int(time.time())) s = f'AccessKeyId={self.key}&SignatureNonce={nonce}&Timestamp={ts}' h = hmac.new(self.secret.encode(), s.encode(), hashlib.sha1).hexdigest() return { 'X-Aic-AccessKey-Id': self.key, 'X-Aic-Signature-Nonce': nonce, 'X-Aic-Timestamp': ts, 'X-Aic-Signature': base64.b64encode(h.encode()).decode(), 'User-Agent': 'AiCoin-Freqtrade/2.0', } def _call(self, method: str, path: str, params: dict = None): """Sign and send a v3 request. Returns the envelope's `data`, or raises.""" full = '/api/v3/' + path.strip('/').replace('api/v3/', '', 1) headers = self._auth_headers() if method == 'GET': clean = {k: (','.join(map(str, v)) if isinstance(v, (list, tuple)) else v) for k, v in (params or {}).items() if v not in (None, '')} qs = urlencode(clean) req = Request(self.base + full + (('?' + qs) if qs else ''), headers=headers) else: headers['Content-Type'] = 'application/json' req = Request(self.base + full, data=json.dumps(params or {}).encode(), headers=headers, method='POST') try: with urlopen(req, timeout=30) as resp: body = json.loads(resp.read()) ``` ### Tec ...[truncated 1719 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
lib/defaults.json:1- Finding
Shared AiCoin API Key and Secret Are Hard-Coded in the Package
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (80)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description centers on operating a Freqtrade bot: creating strategies, backtesting, switching strategy/pairs/live mode, and reading bot status, balances, positions, and P&L, with specific claims about supervisord-managed daemons and never spawning competing processes. The supplied code does none of that. It is a standalone SDK/client for AiCoin data intended to be imported into Freqtrade strategies. Its primary behavior is authenticated access to external AiCoin endpoints and derivation of trading signals from that data. While it is related to Freqtrade in the sense that strategies may use it, the actual purpose is materially different from bot lifecycle/control/status management described in the skill. Therefore this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents an orchestration/assistant skill for Freqtrade lifecycle tasks: strategy creation, backtesting, hyperopt, switching modes/strategies/pairs, and querying runtime trading status in CoinClaw or host environments. The supplied code does none of that. It is a standalone Freqtrade strategy class named FundingRateStrategy. Its primary purpose is to generate trading signals using Bollinger Bands, RSI, volume, and optionally live funding-rate data from an AiCoin data source. It also accesses an external module (aicoin_data) to fetch funding rates during live/dry-run operation, which is a specific market-data dependency not reflected in the declared skill purpose. This is a material purpose mismatch: the description is for a Freqtrade management skill, while the code is strategy logic for one particular strategy.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
There is a material mismatch between the declared purpose and the supplied code chunk. The description presents a broad Freqtrade management skill that can create strategies, run backtests/hyperopt, switch bot modes/strategies/pairs, inspect bot status and P&L, and auto-detect CoinClaw environment behavior. The actual code chunk is not such an orchestration/management tool; it is only a concrete Freqtrade strategy class. Its primary purpose is to generate trade signals using ATR, momentum, RSI, EMA, volume, and optional AiCoin liquidation/open-interest inputs. While strategy creation is one trigger in the declared description, this code alone does not represent the broader declared operational capabilities, and it introduces concrete AiCoin live data access behavior not captured as the main function of the declared skill. Therefore the description does not accurately represent what this supplied code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description is for a broad operational Freqtrade assistant/orchestrator: create strategies, run backtests and hyperopt, switch runtime configuration, and inspect live trading state. The supplied code chunk instead is just a strategy class for Freqtrade. Its primary function is generating trading signals using RSI, EMA, volume, and optional live AiCoin whale/long-short sentiment data. While this is loosely within the Freqtrade domain, it materially does not implement the described management capabilities, environment auto-detection, daemon handling, or live bot/account querying. Therefore the description does not accurately represent what this code chunk actually does.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/ft.mjs` + `scripts/ft-deploy.mjs` 内置三引擎自动识别(`lib/coinclaw-env.mjs`), 路径 / auth / supervisord socket 都自动解析, **agent 不用关心是哪个引擎**.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/ft.mjs` + `scripts/ft-deploy.mjs` 内置三引擎自动识别(`lib/coinclaw-env.mjs`), 路径 / auth / supervisord socket 都自动解析, **agent 不用关心是哪个引擎**.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/ft.mjs` + `scripts/ft-deploy.mjs` 内置三引擎自动识别(`lib/coinclaw-env.mjs`), 路径 / auth / supervisord socket 都自动解析, **agent 不用关心是哪个引擎**.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/ft.mjs` + `scripts/ft-deploy.mjs` 内置三引擎自动识别(`lib/coinclaw-env.mjs`), 路径 / auth / supervisord socket 都自动解析, **agent 不用关心是哪个引擎**.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/ft.mjs` + `scripts/ft-deploy.mjs` 内置三引擎自动识别(`lib/coinclaw-env.mjs`), 路径 / auth / supervisord socket 都自动解析, **agent 不用关心是哪个引擎**.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/ft.mjs` + `scripts/ft-deploy.mjs` 内置三引擎自动识别(`lib/coinclaw-env.mjs`), 路径 / auth / supervisord socket 都自动解析, **agent 不用关心是哪个引擎**.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/ft.mjs` + `scripts/ft-deploy.mjs` 内置三引擎自动识别(`lib/coinclaw-env.mjs`), 路径 / auth / supervisord socket 都自动解析, **agent 不用关心是哪个引擎**.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/ft.mjs` + `scripts/ft-deploy.mjs` 内置三引擎自动识别(`lib/coinclaw-env.mjs`), 路径 / auth / supervisord socket 都自动解析, **agent 不用关心是哪个引擎**.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/ft.mjs` + `scripts/ft-deploy.mjs` 内置三引擎自动识别(`lib/coinclaw-env.mjs`), 路径 / auth / supervisord socket 都自动解析, **agent 不用关心是哪个引擎**.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/ft.mjs` + `scripts/ft-deploy.mjs` 内置三引擎自动识别(`lib/coinclaw-env.mjs`), 路径 / auth / supervisord socket 都自动解析, **agent 不用关心是哪个引擎**.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/ft.mjs` + `scripts/ft-deploy.mjs` 内置三引擎自动识别(`lib/coinclaw-env.mjs`), 路径 / auth / supervisord socket 都自动解析, **agent 不用关心是哪个引擎**.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/ft.mjs` + `scripts/ft-deploy.mjs` 内置三引擎自动识别(`lib/coinclaw-env.mjs`), 路径 / auth / supervisord socket 都自动解析, **agent 不用关心是哪个引擎**.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/ft.mjs` + `scripts/ft-deploy.mjs` 内置三引擎自动识别(`lib/coinclaw-env.mjs`), 路径 / auth / supervisord socket 都自动解析, **agent 不用关心是哪个引擎**.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/ft.mjs` + `scripts/ft-deploy.mjs` 内置三引擎自动识别(`lib/coinclaw-env.mjs`), 路径 / auth / supervisord socket 都自动解析, **agent 不用关心是哪个引擎**.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/ft.mjs` + `scripts/ft-deploy.mjs` 内置三引擎自动识别(`lib/coinclaw-env.mjs`), 路径 / auth / supervisord socket 都自动解析, **agent 不用关心是哪个引擎**.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/ft.mjs` + `scripts/ft-deploy.mjs` 内置三引擎自动识别(`lib/coinclaw-env.mjs`), 路径 / auth / supervisord socket 都自动解析, **agent 不用关心是哪个引擎**.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/ft.mjs` + `scripts/ft-deploy.mjs` 内置三引擎自动识别(`lib/coinclaw-env.mjs`), 路径 / auth / supervisord socket 都自动解析, **agent 不用关心是哪个引擎**.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/ft.mjs` + `scripts/ft-deploy.mjs` 内置三引擎自动识别(`lib/coinclaw-env.mjs`), 路径 / auth / supervisord socket 都自动解析, **agent 不用关心是哪个引擎**.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/ft.mjs` + `scripts/ft-deploy.mjs` 内置三引擎自动识别(`lib/coinclaw-env.mjs`), 路径 / auth / supervisord socket 都自动解析, **agent 不用关心是哪个引擎**.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/ft.mjs` + `scripts/ft-deploy.mjs` 内置三引擎自动识别(`lib/coinclaw-env.mjs`), 路径 / auth / supervisord socket 都自动解析, **agent 不用关心是哪个引擎**.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/ft.mjs` + `scripts/ft-deploy.mjs` 内置三引擎自动识别(`lib/coinclaw-env.mjs`), 路径 / auth / supervisord socket 都自动解析, **agent 不用关心是哪个引擎**.
Static analysis
Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/ft-deploy.mjs:58
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/ft.mjs:34
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- lib/freqtrade-api.mjs:28
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/ft-deploy.mjs:87
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/ft-deploy.mjs:255