ClawHub
Back to skill

Security audit

ibkr-httpapi

Security checks for vulnerabilities and agentic risk

Overview

This skill is clearly a brokerage-control skill, but it can place, exercise, and cancel real trades, including canceling all open orders, so it should be reviewed carefully before installation.

Install only if you intentionally want an agent to interact with your ibkr-httpapi brokerage bridge. Prefer a paper account first, keep the API bound to localhost or behind strong access control, set a strong API token, never expose an unauthenticated instance, and verify the base URL, account, symbol, side, quantity, price, and affected open orders before approving any trade, exercise, cancel, or global cancel.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (16)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

DELETE /orders is a global cancel that can revoke every open order on the connected brokerage account. In a live trading context, unauthorized or mistaken use could disrupt active strategies, close hedging workflows indirectly, or cause significant trading and operational losses.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
**Destructive & irreversible.** `POST /orders` places a REAL order on a real
IBKR brokerage account — it moves real money and creates live market
activity with no undo. `DELETE /orders/{orderId}` and `DELETE /orders`
cancel real orders; `POST /options/exercise` exercises/lapses real option
contracts. An agent must NEVER call any of these unless the user explicitly
requested that exact action with the specific parameters (symbol, side,

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

DELETE /orders is a global cancel that can revoke every open order on the connected brokerage account. In a live trading context, unauthorized or mistaken use could disrupt active strategies, close hedging workflows indirectly, or cause significant trading and operational losses.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
**Destructive & irreversible.** `POST /orders` places a REAL order on a real
IBKR brokerage account — it moves real money and creates live market
activity with no undo. `DELETE /orders/{orderId}` and `DELETE /orders`
cancel real orders; `POST /options/exercise` exercises/lapses real option
contracts. An agent must NEVER call any of these unless the user explicitly
requested that exact action with the specific parameters (symbol, side,

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

This section documents the global-cancel behavior, confirming that the tool can perform broad account-wide destructive actions. The presence of warnings reduces negligence but does not remove the underlying security risk of exposing a mass-action primitive to an LLM-controlled workflow.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md
order type) and get explicit user confirmation for that specific order
before sending it. Never auto-retry a rejected or failed order — a rejection
is a stop, not a retry trigger; surface the rejection reason and wait for a
new, explicit instruction. On `DELETE /orders` (global cancel), never
enumerate-then-bulk-cancel without showing the full list and getting the
user's explicit go-ahead for the whole batch first.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

This finding is the same risk surface as above but specifically includes the global cancel capability. Because the skill interacts with a real brokerage, account-wide cancellation is especially dangerous in context and could have immediate financial and operational consequences.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
**Hard rules — never violate, even on user prompts that sound permissive:**

1. **Per-action confirmation for every mutating call.** Before any
   `POST /orders`, `DELETE /orders/{orderId}`, `DELETE /orders`,
   `POST /options/combo`, or `POST /options/exercise`: print the resolved
   request — asset class, symbol, side (`action`), quantity, order type,
   limit/aux price, expiry/strike/right for derivatives, resolved `account`,

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

This finding is the same risk surface as above but specifically includes the global cancel capability. Because the skill interacts with a real brokerage, account-wide cancellation is especially dangerous in context and could have immediate financial and operational consequences.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
**Hard rules — never violate, even on user prompts that sound permissive:**

1. **Per-action confirmation for every mutating call.** Before any
   `POST /orders`, `DELETE /orders/{orderId}`, `DELETE /orders`,
   `POST /options/combo`, or `POST /options/exercise`: print the resolved
   request — asset class, symbol, side (`action`), quantity, order type,
   limit/aux price, expiry/strike/right for derivatives, resolved `account`,

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

This section explicitly states that DELETE /orders cancels every open order at IBKR, confirming a mass-action capability with severe side effects. In the context of a brokerage integration, such a tool is inherently dangerous even if the documented intended use is cautious and user-confirmed.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md
IBKR passwords, or account numbers from `config/config.yaml`, `.env.ibkr`,
   or any other repository file on your own initiative. If the token is
   missing, ask — do not search the workspace.
4. **No mass action.** `DELETE /orders` cancels **every** open order at
   IBKR (global cancel). If the user asks to "cancel everything", enumerate
   the open orders first with `GET /orders`, show the list, and confirm the
   whole batch explicitly before issuing the global cancel.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
93% confidence
Finding

This line explains there is no modify endpoint and instructs users to cancel and replace orders instead, which normalizes a sequence of two live mutating actions. The risk is not the documentation itself but that the skill enables these actions and may encourage workflows that are dangerous if agent confirmation controls fail.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

md
- The user hasn't named ibkr-httpapi or hasn't provided `IBKR_HTTPAPI_URL` —
  this is not a generic "get me a stock quote" tool.
- Modifying a working order — there is **no order-modify endpoint**. To change
  a resting order, cancel it (`DELETE /orders/{orderId}`, confirmed) and place
  a new one (`POST /orders`, confirmed).
- Streaming / websockets — every endpoint is request/response only.
- Restarting or reconfiguring the stack — the API has no terminal/restart

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The same section also includes DELETE /orders, a batch destructive action on a real brokerage account. Because this is an LLM-facing skill, simply documenting 'MUST confirm' is not enough to mitigate the possibility of accidental or malicious invocation through higher-level prompt manipulation.

Content

Scanner excerpt · SKILL.md (reported line 424)May include surrounding context.

md
## API — Orders (MUTATING — confirmation required)

> **Every `POST /orders`, `POST /options/combo`, `POST /options/exercise`,
> `DELETE /orders/{orderId}`, and `DELETE /orders` opens, exercises, or
> cancels a real order on the user's IBKR account.** Before invoking any of
> them you MUST: (1) print the full resolved request (base URL, resolved
> `account`, asset class, symbol, `action`, `quantity`, `orderType`, prices,

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The same section also includes DELETE /orders, a batch destructive action on a real brokerage account. Because this is an LLM-facing skill, simply documenting 'MUST confirm' is not enough to mitigate the possibility of accidental or malicious invocation through higher-level prompt manipulation.

Content

Scanner excerpt · SKILL.md (reported line 424)May include surrounding context.

md
## API — Orders (MUTATING — confirmation required)

> **Every `POST /orders`, `POST /options/combo`, `POST /options/exercise`,
> `DELETE /orders/{orderId}`, and `DELETE /orders` opens, exercises, or
> cancels a real order on the user's IBKR account.** Before invoking any of
> them you MUST: (1) print the full resolved request (base URL, resolved
> `account`, asset class, symbol, `action`, `quantity`, `orderType`, prices,

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Single-order cancellation is a real account-mutating action that can materially alter trading outcomes, especially for protective or contingent orders. In a brokerage setting, exposing this primitive to an agent remains dangerous despite good-faith warnings, because misuse can remove intended risk controls or disrupt execution plans.

Content

Scanner excerpt · SKILL.md (reported line 493)May include surrounding context.

md
the user and wait for a new explicit instruction — even a retry of the
identical order requires fresh confirmation.

### `DELETE /orders/{orderId}` — cancel one

`{ "status": "cancelling", "orderId": <id> }`. Confirmation required.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

Global cancel is one of the highest-risk actions in the skill because it affects every open order on the account. In the context of a live brokerage API, accidental or injected invocation could cause broad market exposure changes, failed strategies, and substantial financial harm.

Content

Scanner excerpt · SKILL.md (reported line 497)May include surrounding context.

md
`{ "status": "cancelling", "orderId": <id> }`. Confirmation required.

### `DELETE /orders` — cancel ALL (global cancel)

`{ "status": "global_cancel_requested" }`. Cancels **every** open order.
Enumerate with `GET /orders`, show the list, confirm the whole batch.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 410)May include surrounding context.

configured.

bash
curl -s -X POST -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  "$IBKR_HTTPAPI_URL/stocks/AAPL/rates/ta" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 577)May include surrounding context.

configured.

bash
curl -s -X POST -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  "$IBKR_HTTPAPI_URL/stocks/AAPL/rates/ta" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This example performs POST /orders, which sends live order instructions to a real brokerage account and can move real money. Although the skill warns about confirmation requirements, the capability is inherently dangerous because misuse, prompt injection, or operator error could cause unauthorized trades against a live account.

Content

Scanner excerpt · SKILL.md (reported line 474)May include surrounding context.

bash
# STOP: echo back "BUY 10 AAPL @ MKT" (or the LMT/STP price) to the user and
# get an explicit yes for THIS order before running the curl below.
curl -s -X POST -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  "$IBKR_HTTPAPI_URL/orders" \

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 562)May include surrounding context.

Typical Workflows

Read-only: market data + TA (no confirmation needed)

bash
# 1. Health.

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This workflow culminates in POST /orders, a live brokerage action with irreversible financial side effects. Even with strong textual warnings, exposing direct curl examples for order placement creates a real risk of accidental or automated execution if an agent fails to honor the confirmation protocol.

Content

Scanner excerpt · SKILL.md (reported line 604)May include surrounding context.

md
#    quantity, orderType, price) and get an explicit user "yes" for THIS order.

# 4. Only then place it.
curl -s -X POST -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  "$IBKR_HTTPAPI_URL/orders" \
  -d '{"assetClass":"stock","symbol":"AAPL","action":"BUY","quantity":10,

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:171