Security audit

aicoin-trading

Security checks for vulnerabilities and agentic risk

Overview

This trading skill can place real exchange orders and includes an automated path that bypasses its promised user-confirmation workflow.

Do not install or use this skill for real funds unless you have reviewed the auto-trading scripts, removed the confirmation bypass, and are comfortable providing least-privilege exchange API keys with withdrawals disabled. If you proceed, avoid scripts/trade.mjs, require manual confirmation for every order, and review the runtime npm install and broker/referral attribution behavior.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/auto-trade.mjs:38

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/exchange.mjs:57

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/trade.mjs:10

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: lib/aicoin-api.mjs:12