ClawHub
Back to skill

Security audit

ibkr-httpapi

Security checks across malware telemetry and agentic risk

Overview

This skill is a clearly disclosed IBKR trading API helper with real-money risk, but its sensitive actions are purpose-aligned and repeatedly gated by explicit user confirmation.

Install only if you intentionally want an agent to interact with your IBKR bridge. Keep the service bound to localhost or behind strong authentication, set a strong API token, prefer paper trading until tested, and verify every resolved account/order/cancel/exercise confirmation before approving it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

External Transmission

Medium
Category
Data Exfiltration
Content
"$IBKR_HTTPAPI_URL/stocks/AAPL/rates?duration=1+Y&barSize=1+day&whatToShow=ADJUSTED_LAST" | jq '.bars | length'

# 4. Same bars + TA in one call.
curl -s -X POST -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  "$IBKR_HTTPAPI_URL/stocks/AAPL/rates/ta" \
  -d '{"duration":"400 D","barSize":"1 day","whatToShow":"ADJUSTED_LAST",
Confidence
60% confidence
Finding
curl -s -X POST -H "Authorization: Bearer $API_TOKEN" \ -H "Content-Type: application/json" \ "$IBKR_HTTPAPI_URL/stocks/AAPL/rates/ta" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
#    quantity, orderType, price) and get an explicit user "yes" for THIS order.

# 4. Only then place it.
curl -s -X POST -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  "$IBKR_HTTPAPI_URL/orders" \
  -d '{"assetClass":"stock","symbol":"AAPL","action":"BUY","quantity":10,
Confidence
60% confidence
Finding
curl -s -X POST -H "Authorization: Bearer $API_TOKEN" \ -H "Content-Type: application/json" \ "$IBKR_HTTPAPI_URL/orders" \ -d

Tool Parameter Abuse

High
Category
Tool Misuse
Content
**Destructive & irreversible.** `POST /orders` places a REAL order on a real
IBKR brokerage account — it moves real money and creates live market
activity with no undo. `DELETE /orders/{orderId}` and `DELETE /orders`
cancel real orders; `POST /options/exercise` exercises/lapses real option
contracts. An agent must NEVER call any of these unless the user explicitly
requested that exact action with the specific parameters (symbol, side,
Confidence
80% confidence
Finding
DELETE /orders/{orderId}`

Tool Parameter Abuse

High
Category
Tool Misuse
Content
**Destructive & irreversible.** `POST /orders` places a REAL order on a real
IBKR brokerage account — it moves real money and creates live market
activity with no undo. `DELETE /orders/{orderId}` and `DELETE /orders`
cancel real orders; `POST /options/exercise` exercises/lapses real option
contracts. An agent must NEVER call any of these unless the user explicitly
requested that exact action with the specific parameters (symbol, side,
Confidence
80% confidence
Finding
DELETE /orders`

Tool Parameter Abuse

High
Category
Tool Misuse
Content
order type) and get explicit user confirmation for that specific order
before sending it. Never auto-retry a rejected or failed order — a rejection
is a stop, not a retry trigger; surface the rejection reason and wait for a
new, explicit instruction. On `DELETE /orders` (global cancel), never
enumerate-then-bulk-cancel without showing the full list and getting the
user's explicit go-ahead for the whole batch first.
Confidence
80% confidence
Finding
DELETE /orders`

Tool Parameter Abuse

High
Category
Tool Misuse
Content
**Hard rules — never violate, even on user prompts that sound permissive:**

1. **Per-action confirmation for every mutating call.** Before any
   `POST /orders`, `DELETE /orders/{orderId}`, `DELETE /orders`,
   `POST /options/combo`, or `POST /options/exercise`: print the resolved
   request — asset class, symbol, side (`action`), quantity, order type,
   limit/aux price, expiry/strike/right for derivatives, resolved `account`,
Confidence
80% confidence
Finding
DELETE /orders/{orderId}`,

Tool Parameter Abuse

High
Category
Tool Misuse
Content
**Hard rules — never violate, even on user prompts that sound permissive:**

1. **Per-action confirmation for every mutating call.** Before any
   `POST /orders`, `DELETE /orders/{orderId}`, `DELETE /orders`,
   `POST /options/combo`, or `POST /options/exercise`: print the resolved
   request — asset class, symbol, side (`action`), quantity, order type,
   limit/aux price, expiry/strike/right for derivatives, resolved `account`,
Confidence
80% confidence
Finding
DELETE /orders`,

Tool Parameter Abuse

High
Category
Tool Misuse
Content
IBKR passwords, or account numbers from `config/config.yaml`, `.env.ibkr`,
   or any other repository file on your own initiative. If the token is
   missing, ask — do not search the workspace.
4. **No mass action.** `DELETE /orders` cancels **every** open order at
   IBKR (global cancel). If the user asks to "cancel everything", enumerate
   the open orders first with `GET /orders`, show the list, and confirm the
   whole batch explicitly before issuing the global cancel.
Confidence
80% confidence
Finding
DELETE /orders`

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- The user hasn't named ibkr-httpapi or hasn't provided `IBKR_HTTPAPI_URL` —
  this is not a generic "get me a stock quote" tool.
- Modifying a working order — there is **no order-modify endpoint**. To change
  a resting order, cancel it (`DELETE /orders/{orderId}`, confirmed) and place
  a new one (`POST /orders`, confirmed).
- Streaming / websockets — every endpoint is request/response only.
- Restarting or reconfiguring the stack — the API has no terminal/restart
Confidence
80% confidence
Finding
DELETE /orders/{orderId}`,

Tool Parameter Abuse

High
Category
Tool Misuse
Content
## API — Orders (MUTATING — confirmation required)

> **Every `POST /orders`, `POST /options/combo`, `POST /options/exercise`,
> `DELETE /orders/{orderId}`, and `DELETE /orders` opens, exercises, or
> cancels a real order on the user's IBKR account.** Before invoking any of
> them you MUST: (1) print the full resolved request (base URL, resolved
> `account`, asset class, symbol, `action`, `quantity`, `orderType`, prices,
Confidence
80% confidence
Finding
DELETE /orders/{orderId}`,

Tool Parameter Abuse

High
Category
Tool Misuse
Content
## API — Orders (MUTATING — confirmation required)

> **Every `POST /orders`, `POST /options/combo`, `POST /options/exercise`,
> `DELETE /orders/{orderId}`, and `DELETE /orders` opens, exercises, or
> cancels a real order on the user's IBKR account.** Before invoking any of
> them you MUST: (1) print the full resolved request (base URL, resolved
> `account`, asset class, symbol, `action`, `quantity`, `orderType`, prices,
Confidence
80% confidence
Finding
DELETE /orders`

Tool Parameter Abuse

High
Category
Tool Misuse
Content
the user and wait for a new explicit instruction — even a retry of the
identical order requires fresh confirmation.

### `DELETE /orders/{orderId}` — cancel one

`{ "status": "cancelling", "orderId": <id> }`. Confirmation required.
Confidence
80% confidence
Finding
DELETE /orders/{orderId}`

Tool Parameter Abuse

High
Category
Tool Misuse
Content
`{ "status": "cancelling", "orderId": <id> }`. Confirmation required.

### `DELETE /orders` — cancel ALL (global cancel)

`{ "status": "global_cancel_requested" }`. Cancels **every** open order.
Enumerate with `GET /orders`, show the list, confirm the whole batch.
Confidence
80% confidence
Finding
DELETE /orders`

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:171