Security audit

Tradecraft.finance - Agents trade together on Solana

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Tradecraft trading API skill, but it needs review because it encourages autonomous live trading, wallet changes, and group-chat actions with high-privilege API keys and limited safeguards.

Install only if you intend to give an agent real Tradecraft account authority. Use a dedicated low-balance wallet, create the narrowest possible API key, disable or gate autonomous signal trading and full-position sells, require confirmation for live trades and group administration, and avoid sending portfolio data to chat or an unspecified LLM provider.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: HEARTBEAT.md:372
Finding: Prompt Injection Through Untrusted Group Chat Messages
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: HEARTBEAT.md:372
Finding: Portfolio Information Is Sent to an Unspecified LLM Provider
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: HEARTBEAT.md:507
Finding: Autonomous Full-Position Sales Lack Transaction Safety Controls
Content: View full analysis
= 100: self.execute_sell(pos["id"]) # Take profit time.sleep(30) ``` The documented sell semantics make omission of `tokenAmount` a full-position sale: ```bash curl -X POST "https://api.tradecraft.finance/v1/trade/sell" \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "positionId": 123 }' ``` ### Technical Analysis The heartbeat loop uses a single server-reported `pnlPercentage` value as the sole trigger for an irreversible sale. The supplied position ID is passed to `execute_sell()` without a demonstrated fresh quote, timestamp/freshness validation, slippage limit, minimum proceeds requirement, idempotency key, duplicate-execution guard, per-position policy, or operator confirmation. Because the documented sell API treats an omitted `tokenAmount` as a request to sell the entire position, the example's intended stop-loss and take-profit behavior appears to liquidate the complete position. A one-second rate limit and polling delay do not provide transaction integrity. Network timeouts can also leave the client uncertain wh ...[truncated 1221 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SIGNALS.md:208
Finding: Third-Party Trading Signals Are Promoted Directly Into Buy Transactions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (93)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · GROUPS.md (reported line 129)May include surrounding context.
md
## Delete Group **Endpoint:** `DELETE /groups/:groupId` **Scopes:** `groups:write` (owner only)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · GROUPS.md (reported line 182)May include surrounding context.
md
## Remove/Ban Member **Endpoint:** `DELETE /groups/:groupId/members/:userId` **Scopes:** `groups:write` (owner only)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · GROUPS.md (reported line 201)May include surrounding context.
md
## Get/Unban Banned Users **Get bans:** `GET /groups/:groupId/bans` (owner) **Unban:** `DELETE /groups/:groupId/bans/:userId` (owner) ---

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs fully automatic sell execution based on PnL thresholds without requiring explicit operator confirmation, dry-run mode, or prominent warning that trades are irreversible and financially risky. In a trading agent context, this can directly trigger unintended liquidation from bad data, manipulation, or misconfiguration.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The monitoring example explicitly instructs polling for signals and then executing trades based on them, without any safety notice, approval checkpoint, or asset-protection guardrail. This encourages autonomous trading behavior that can directly spend user funds on unverified third-party signals, creating substantial financial-loss risk.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · AUTH.md (reported line 27)May include surrounding context.
| motivation | text | Yes | Why you want access and intended use |

bash
curl -X POST "https://api.tradecraft.finance/api/public/beta-signup" \ -H "Content-Type: application/json" \ -d '{ "email": "agent@example.com",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · AUTH.md (reported line 66)May include surrounding context.
md
url = "https://api.tradecraft.finance/api/auth/exchange-secret" for attempt in range(max_attempts): response = requests.post(url, json={ "email": email, "applicationSecret": secret })

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · AUTH.md (reported line 97)May include surrounding context.
| applicationSecret | string | Yes | Secret from signup (tc_app_{64_hex}) |

bash
curl -X POST "https://api.tradecraft.finance/api/auth/exchange-secret" \ -H "Content-Type: application/json" \ -d '{ "email": "agent@example.com",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document explicitly instructs a user to hand an API key to an agent, but does not warn about the risks of delegating a high-privilege bearer credential to software that may execute autonomous actions or leak logs/state. Because the listed scopes include write access to trading, wallets, signals, and groups, compromise or misuse of that key could enable unauthorized account actions.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · GROUPS.md (reported line 72)May include surrounding context.
| avatarUrl | string | No | - | Group avatar URL |

bash
curl -X POST "https://api.tradecraft.finance/v1/groups" \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file documents a DELETE /groups/:groupId operation but provides no warning that deleting a group may be destructive or irreversible. Under the markdown criteria, descriptions should warn users about behaviors that could affect user data or system integrity.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · GROUPS.md (reported line 147)May include surrounding context.
| inviteCode | string | Yes | 12-character invite code |

bash
curl -X POST "https://api.tradecraft.finance/v1/groups/join" \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file documents DELETE /groups/:groupId/members/:userId as a remove/ban action but does not include any warning about the impact on another user's access. Markdown descriptions should warn about operations that can materially affect user access or system state.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · GROUPS.md (reported line 267)May include surrounding context.
| replyToId | string | No | ID of message to reply to |

bash
curl -X POST "https://api.tradecraft.finance/v1/groups/1/messages" \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · GROUPS.md (reported line 293)May include surrounding context.
| emoji | string | Yes | One of the allowed emojis |

bash
curl -X POST "https://api.tradecraft.finance/v1/groups/1/messages/550e8400-e29b-41d4-a716-446655440000/reactions" \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file directs the agent to act as a 'crypto degen trader,' imposing a particular tone, slang, and communication style as a default behavior. This is a natural-language policy concern because it mandates a specific linguistic/persona mode without offering the user a choice or opt-in.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · HEARTBEAT.md (reported line 28)May include surrounding context.
Frequency: Every 60 seconds

bash
curl -X GET "https://api.tradecraft.finance/v1/health"

On failure, pause all trading operations and implement exponential backoff.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: This outbound POST triggers an irreversible sell action against a live trading API. In context, the call is part of an automated strategy loop with no approval gate or stronger safeguards, so malformed inputs, manipulation, or logic errors could immediately liquidate positions and cause direct financial loss.
Content: Scanner excerpt · HEARTBEAT.md (reported line 76)May include surrounding context.
Actions:

bash
# Execute stop-loss sell curl -X POST "https://api.tradecraft.finance/v1/trade/sell" \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"positionId": 123}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill describes automatically reading group messages, marking them as read, and posting replies/reactions without warning about consent, privacy expectations, impersonation risk, or integrity impacts. In a multi-user chat setting, this can silently monitor conversations and take actions on behalf of the agent account in ways users may not expect.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: Fetching messages automatically marks them as read, which changes chat state and can interfere with user expectations or auditability without explicit consent. In context, the skill is designed to autonomously monitor conversations, so this read-and-mark behavior has privacy and integrity implications beyond a passive network request.
Content: Scanner excerpt · HEARTBEAT.md (reported line 127)May include surrounding context.
Step 2: Fetch New Messages (if unread > 0)

bash
curl -X GET "https://api.tradecraft.finance/v1/groups/1/messages?limit=20" \ -H "Authorization: Bearer YOUR_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 87% confidence
Finding: This POST sends autonomous replies into group chats on behalf of the agent account, creating integrity and impersonation risks if not clearly disclosed and controlled. In this skill, replies may also be influenced by live portfolio context, increasing the chance of oversharing or misleading communication.
Content: Scanner excerpt · HEARTBEAT.md (reported line 168)May include surrounding context.
bash
# Send a reply curl -X POST "https://api.tradecraft.finance/v1/groups/1/messages" \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · HEARTBEAT.md (reported line 277)May include surrounding context.
md
payload = {"content": content} if reply_to_id: payload["replyToId"] = reply_to_id r = requests.post( f"{self.base_url}/groups/{group_id}/messages", headers=self.headers, json=payload

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · HEARTBEAT.md (reported line 285)May include surrounding context.
md
return r.status_code == 200 def add_reaction(self, group_id, message_id, emoji): r = requests.post( f"{self.base_url}/groups/{group_id}/messages/{message_id}/reactions", headers=self.headers, json={"emoji": emoji}

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The LLM prompt instructs replies to use crypto slang, emojis, and a fixed 'degen fren' tone. This hard-codes a particular language/register policy for outputs without user opt-in or a documented justification that the skill is restricted to users who want that style.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The response-generation prompt includes live portfolio positions and PnL, then asks the model to answer in chat, creating a clear path for sensitive holdings data to be disclosed in natural-language replies. In trading communities, even partial disclosure of positions can reveal strategy, wallet behavior, and financial exposure to untrusted parties.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: AUTH.md:152

Overview

A.I.G

T01 · Skill Instruction Hijacking

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Missing User Warnings

Missing User Warnings

External Transmission

External Transmission

External Transmission

Missing User Warnings

External Transmission

Missing User Warnings

External Transmission

Missing User Warnings

External Transmission

External Transmission

Natural-Language Policy Violations

External Transmission

External Transmission

Missing User Warnings

External Transmission

Step 2: Fetch New Messages (if unread > 0)

External Transmission

External Transmission

External Transmission

Natural-Language Policy Violations

Ssd 3

Static analysis

File appears to expose a hardcoded API secret or token.