T03 · Remote Payload Retrieval and Execution
Error
- Location
install.sh:181- Finding
Unverified Remote Installer Is Piped Directly into a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
nexustrader
Security checks for vulnerabilities and agentic risk
Overview
This trading skill is purpose-aligned but needs review because it can use local exchange API keys to perform live trades and relies on weak, mostly instructional safeguards.
Install only if you are comfortable giving this skill access to exchange API keys and possible live trading authority. Use testnet/demo keys first, remove withdrawal permissions, keep auto-start disabled unless you intentionally want a background daemon, avoid following curl-to-shell install commands without verification, and restrict the MCP server to a trusted local endpoint. Do not use live accounts until there is a real code-level confirmation or allowlist for order-changing tools.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
bridge.py:333- Finding
Real Trading Operations Lack Code-Level Authorization Enforcement
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
nexustrader_daemon.sh:12- Finding
Skill Configuration File Is Executed as Arbitrary Shell Code
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (32)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
Piping
curloutput directly intoshis a high-risk execution pattern because it removes any opportunity to inspect downloaded code before running it. In the context of a crypto trading assistant, compromise of the host can lead to theft of exchange API keys, account manipulation, fraudulent trades, or persistence on a financially sensitive workstation.- Content
2. 安装 uv（如未安装）
Linux / macOS:
curl -LsSf https://astral.sh/uv/install.sh | sh
Windows (PowerShell):
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
text
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill is described primarily as performing trading operations, yet the content also includes process lifecycle implications through optional daemon auto-start and dependency on local service management. This broader behavior matters because background services holding exchange-key access change the risk profile from simple querying/trading to persistent local privileged operation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill is described primarily as performing trading operations, yet the content also includes process lifecycle implications through optional daemon auto-start and dependency on local service management. This broader behavior matters because background services holding exchange-key access change the risk profile from simple querying/trading to persistent local privileged operation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is described primarily as performing trading operations, yet the content also includes process lifecycle implications through optional daemon auto-start and dependency on local service management. This broader behavior matters because background services holding exchange-key access change the risk profile from simple querying/trading to persistent local privileged operation.
- Content
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: nexustrader description: NexusTrader trading assistant. Query crypto balances, positions, prices, and place orders on Binance, Bybit, OKX, Bitget, HyperLiquid. credentials: - name: NEXUSTRADER_API_KEYS description: "Exchange API keys in .keys/.secrets.toml (local file, not transmitted)" scope: "local_file" required: true env: - name: NEXUSTRADER_MCP_URL description: "MCP server URL (default: http://127.0.0.1:18765/sse)" required: false - name: NEXUSTRADER_PROJECT_DIR description: "Path to NexusTrader-mcp project (default: ~/NexusTrader-mcp)" required: false
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The skill explicitly states it reads
.envand.keys/.secrets.tomlfrom a local project directory and may start a daemon with exchange API key access. Even though it claims keys are local-only, any skill that can trigger components operating with live trading credentials materially increases the risk of unauthorized account actions or secret exposure through logs, subprocesses, or overly broad MCP capabilities.- Content
md network: - "127.0.0.1:18765 (local MCP server via SSE)" side_effects: - "Auto-start is DISABLED by default (NEXUSTRADER_NO_AUTOSTART=1). Set to 0 in .env to enable." - "If auto-start is enabled: starts nexustrader-mcp as a background daemon with exchange API key access" - "Reads .env and .keys/.secrets.toml from local NexusTrader-mcp project directory" - "Can execute real trades via create_order/cancel_order/modify_order (requires explicit user confirmation)"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
The documented side effects confirm that auto-started background processes can hold exchange API key access while reading local
.envand secret material. In the context of a trading skill, this is especially sensitive because compromise or misuse can lead directly to financial loss rather than mere data disclosure.- Content
md side_effects: - "Auto-start is DISABLED by default (NEXUSTRADER_NO_AUTOSTART=1). Set to 0 in .env to enable." - "If auto-start is enabled: starts nexustrader-mcp as a background daemon with exchange API key access" - "Reads .env and .keys/.secrets.toml from local NexusTrader-mcp project directory" - "Can execute real trades via create_order/cancel_order/modify_order (requires explicit user confirmation)" ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md from pathlib import Path def _load_skill_env() -> None: """Auto-load .env from skill directory (placed there by `nexustrader-mcp setup`).""" env_file = Path(__file__).resolve().parent / ".env" if not env_file.is_file(): return
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python from pathlib import Path def _load_skill_env() -> None: """Auto-load .env from skill directory (placed there by `nexustrader-mcp setup`).""" env_file = Path(__file__).resolve().parent / ".env" if not env_file.is_file(): return
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python from pathlib import Path def _load_skill_env() -> None: """Auto-load .env from skill directory (placed there by `nexustrader-mcp setup`).""" env_file = Path(__file__).resolve().parent / ".env" if not env_file.is_file(): return
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python from pathlib import Path def _load_skill_env() -> None: """Auto-load .env from skill directory (placed there by `nexustrader-mcp setup`).""" env_file = Path(__file__).resolve().parent / ".env" if not env_file.is_file(): return
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh from pathlib import Path def _load_skill_env() -> None: """Auto-load .env from skill directory (placed there by `nexustrader-mcp setup`).""" env_file = Path(__file__).resolve().parent / ".env" if not env_file.is_file(): return
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def _load_skill_env() -> None: """Auto-load .env from skill directory (placed there by `nexustrader-mcp setup`).""" env_file = Path(__file__).resolve().parent / ".env" if not env_file.is_file(): return for line in env_file.read_text(encoding="utf-8").splitlines():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The bridge prints the filesystem path to the secrets file used by the trading daemon. While it does not reveal the secret contents, exposing secret storage locations in logs or stderr increases operational risk by aiding local attackers, log readers, or adjacent tooling in discovering where high-value credentials live.
- Content
python " Command: uv run nexustrader-mcp start (background process)\n" " API keys in use: " f"{_proj}/.keys/.secrets.toml\n" " To disable auto-start: set NEXUSTRADER_NO_AUTOSTART=1 in skill .env", file=sys.stderr, )
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 82% confidence
- Finding
Using source on a local .env file executes arbitrary shell code, not just environment assignments. If an attacker can modify that file or place a malicious one in the script directory, running the helper would execute attacker-controlled commands with the user's privileges; in a trading assistant context, that could expose API keys, tamper with logs, or redirect operations.
- Content
sh SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" # Load .env to get PROJECT_DIR ENV_FILE="${SCRIPT_DIR}/.env" if [[ -f "${ENV_FILE}" ]]; then set -a; source "${ENV_FILE}"; set +a
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 82% confidence
- Finding
This finding points to the same unsafe pattern: the helper treats .env as shell script via source. In a crypto trading skill, configuration files often sit near sensitive API credentials, so arbitrary code execution from a modified .env can lead to credential theft or unauthorized trading actions indirectly through the user's environment.
- Content
sh SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" # Load .env to get PROJECT_DIR ENV_FILE="${SCRIPT_DIR}/.env" if [[ -f "${ENV_FILE}" ]]; then set -a; source "${ENV_FILE}"; set +a fi
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill invokes
exec/shell-style behavior and interacts with local files and environment variables, but it does not declare an explicit tool scope such aspermissionsorallowed-tools. In a high-risk trading context, missing scope boundaries increases the chance that an agent can use broader local capabilities than users expect, especially around process launch and local secret-bearing paths.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
Optional background daemon startup introduces session persistence: a process can continue running after the immediate user interaction and retain access to exchange API keys. Persistent processes increase attack surface by enabling later unintended actions, stale authenticated state, and harder-to-audit behavior over time.
- Content
md This skill accesses your exchange API keys. Before using: - API keys are stored in `{NEXUSTRADER_PROJECT_DIR}/.keys/.secrets.toml` — a local file, never transmitted by this skill. - **Auto-start is disabled by default.** The skill will not start background processes unless you explicitly set `NEXUSTRADER_NO_AUTOSTART=0` in the skill's `.env` file. - If auto-start is enabled, the NexusTrader-mcp daemon will run in the background and hold access to your API keys. - **Start with testnet/demo keys.** Only use real keys after verifying the workflow in a sandbox. - Orders require explicit user confirmation — verify your agent flow enforces this before live trading.
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction "If exec returns {"error": ...} → explain in Chinese" forces a specific language regardless of the user's preference. This is a natural-language locale policy violation because it does not offer a choice or document a justified region-specific constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring, usage examples, and operational warnings are written in Chinese, including the critical real-trading warning. This imposes a specific language on users without any opt-in, fallback, or stated region-specific justification, matching the locale-policy violation criteria.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This bridge is able to start a local daemon subprocess, a capability not implied by a normal trading-assistant wrapper. In a skill ecosystem, undeclared process-launch behavior is risky because it can persist services, consume credentials from local config, and perform actions beyond the user's apparent request.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 88% confidence
- Finding
The bridge can spawn a local shell script to start a background daemon, which expands the skill's capabilities from querying/trading to local process execution. Although the command is not shell-injected here because arguments are passed as a list and the script path is fixed, subprocess execution still creates a meaningful attack surface if the packaged script is replaced, tampered with, or unexpectedly powerful.
- Content
python """Attempt to start the daemon in the background. Returns True if command succeeded.""" if not _DAEMON_SH.is_file(): return False result = subprocess.run( ["bash", str(_DAEMON_SH), "start"], capture_output=True, text=True,
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script accepts an arbitrary --server URL and also honors an environment override, allowing connections to any reachable MCP endpoint rather than only the expected local server. In this trading context, redirecting the bridge to a malicious server could cause deceptive outputs, unintended tool behavior, credential exposure through downstream auth flows, or coercion into placing trades against attacker-controlled logic.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file title and all user-facing output are written in Chinese, and the script does not offer any alternate language or locale selection. This is a natural-language locale policy concern because the skill imposes a specific language on all users without opt-in or documented justification.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script silently rewrites ~/.openclaw/skills/index.json to assert metadata about required binaries, credentials, environment variables, network access, and trade-capable side effects. Modifying local registry metadata during install can misrepresent trust boundaries and change how the host agent perceives or surfaces the skill's capabilities, which is risky in an agent ecosystem handling trading actions.
- Content
Static analysis
No suspicious patterns detected.