ClawHub
Back to skill

Security audit

ibkr-httpapi

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Interactive Brokers control client with real trading power, but its high-impact actions are purpose-aligned and guarded by explicit confirmation instructions.

Install only if you intentionally use ibkr-httpapi with an IBKR account. Prefer paper trading first, keep the API bound to localhost or behind strong authentication, set a strong API token, and verify every confirmation prompt before allowing live order placement, cancellation, or option exercise.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

External Transmission

Medium
Category
Data Exfiltration
Content
"$IBKR_HTTPAPI_URL/stocks/AAPL/rates?duration=1+Y&barSize=1+day&whatToShow=ADJUSTED_LAST" | jq '.bars | length'

# 4. Same bars + TA in one call.
curl -s -X POST -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  "$IBKR_HTTPAPI_URL/stocks/AAPL/rates/ta" \
  -d '{"duration":"400 D","barSize":"1 day","whatToShow":"ADJUSTED_LAST",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#    quantity, orderType, price) and get an explicit user "yes" for THIS order.

# 4. Only then place it.
curl -s -X POST -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  "$IBKR_HTTPAPI_URL/orders" \
  -d '{"assetClass":"stock","symbol":"AAPL","action":"BUY","quantity":10,
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
**Destructive & irreversible.** `POST /orders` places a REAL order on a real
IBKR brokerage account — it moves real money and creates live market
activity with no undo. `DELETE /orders/{orderId}` and `DELETE /orders`
cancel real orders; `POST /options/exercise` exercises/lapses real option
contracts. An agent must NEVER call any of these unless the user explicitly
requested that exact action with the specific parameters (symbol, side,
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
**Destructive & irreversible.** `POST /orders` places a REAL order on a real
IBKR brokerage account — it moves real money and creates live market
activity with no undo. `DELETE /orders/{orderId}` and `DELETE /orders`
cancel real orders; `POST /options/exercise` exercises/lapses real option
contracts. An agent must NEVER call any of these unless the user explicitly
requested that exact action with the specific parameters (symbol, side,
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
order type) and get explicit user confirmation for that specific order
before sending it. Never auto-retry a rejected or failed order — a rejection
is a stop, not a retry trigger; surface the rejection reason and wait for a
new, explicit instruction. On `DELETE /orders` (global cancel), never
enumerate-then-bulk-cancel without showing the full list and getting the
user's explicit go-ahead for the whole batch first.
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
**Hard rules — never violate, even on user prompts that sound permissive:**

1. **Per-action confirmation for every mutating call.** Before any
   `POST /orders`, `DELETE /orders/{orderId}`, `DELETE /orders`,
   `POST /options/combo`, or `POST /options/exercise`: print the resolved
   request — asset class, symbol, side (`action`), quantity, order type,
   limit/aux price, expiry/strike/right for derivatives, resolved `account`,
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
**Hard rules — never violate, even on user prompts that sound permissive:**

1. **Per-action confirmation for every mutating call.** Before any
   `POST /orders`, `DELETE /orders/{orderId}`, `DELETE /orders`,
   `POST /options/combo`, or `POST /options/exercise`: print the resolved
   request — asset class, symbol, side (`action`), quantity, order type,
   limit/aux price, expiry/strike/right for derivatives, resolved `account`,
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
IBKR passwords, or account numbers from `config/config.yaml`, `.env.ibkr`,
   or any other repository file on your own initiative. If the token is
   missing, ask — do not search the workspace.
4. **No mass action.** `DELETE /orders` cancels **every** open order at
   IBKR (global cancel). If the user asks to "cancel everything", enumerate
   the open orders first with `GET /orders`, show the list, and confirm the
   whole batch explicitly before issuing the global cancel.
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- The user hasn't named ibkr-httpapi or hasn't provided `IBKR_HTTPAPI_URL` —
  this is not a generic "get me a stock quote" tool.
- Modifying a working order — there is **no order-modify endpoint**. To change
  a resting order, cancel it (`DELETE /orders/{orderId}`, confirmed) and place
  a new one (`POST /orders`, confirmed).
- Streaming / websockets — every endpoint is request/response only.
- Restarting or reconfiguring the stack — the API has no terminal/restart
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
## API — Orders (MUTATING — confirmation required)

> **Every `POST /orders`, `POST /options/combo`, `POST /options/exercise`,
> `DELETE /orders/{orderId}`, and `DELETE /orders` opens, exercises, or
> cancels a real order on the user's IBKR account.** Before invoking any of
> them you MUST: (1) print the full resolved request (base URL, resolved
> `account`, asset class, symbol, `action`, `quantity`, `orderType`, prices,
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
## API — Orders (MUTATING — confirmation required)

> **Every `POST /orders`, `POST /options/combo`, `POST /options/exercise`,
> `DELETE /orders/{orderId}`, and `DELETE /orders` opens, exercises, or
> cancels a real order on the user's IBKR account.** Before invoking any of
> them you MUST: (1) print the full resolved request (base URL, resolved
> `account`, asset class, symbol, `action`, `quantity`, `orderType`, prices,
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
the user and wait for a new explicit instruction — even a retry of the
identical order requires fresh confirmation.

### `DELETE /orders/{orderId}` — cancel one

`{ "status": "cancelling", "orderId": <id> }`. Confirmation required.
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
`{ "status": "cancelling", "orderId": <id> }`. Confirmation required.

### `DELETE /orders` — cancel ALL (global cancel)

`{ "status": "global_cancel_requested" }`. Cancels **every** open order.
Enumerate with `GET /orders`, show the list, confirm the whole batch.
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:171