Security audit

Leapcat Skills

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for Leapcat financial and KYC workflows, but it delegates live trading, withdrawals, IPO actions, and identity-data handling to an auto-downloaded npm CLI without enough confirmation or provenance safeguards.

Install only if you trust Leapcat and the exact npm package being executed. Before any trade, IPO subscription/cancel, wallet withdrawal, KYC agreement, or KYC submission, require an explicit user confirmation showing the final account, asset, quantity, price or amount, address, fees, and irreversible effects. Protect OTPs, trade passwords, and token files from logs or prompts, avoid running the CLI with elevated privileges, and prefer verified package installation or sandboxing for sensitive use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:9
Finding: Auto-Downloaded npm CLI Executes Unreviewed Third-Party Code During Sensitive Operations## Vulnerability Details **File Location**: `SKILL.md:9` **Vulnerability Type**: Supply-chain exposure through automatic retrieval and execution of an unreviewed npm package **Risk Level**: Medium ### Vulnerable Code ```markdown A comprehensive set of 7 AI agent skills for the [Leapcat](https://leapcat.ai) platform. All commands use `npx leapcat@0.1.1` — no global install needed, just Node.js 18+. ``` Representative sensitive invocation from `leapcat-trading/SKILL.md:20-34`: ```bash npx leapcat@0.1.1 trading place-order \ --symbol <symbol> \ --exchange <exchange> \ --side <BUY|SELL> \ --order-type <LIMIT|MARKET> \ --quantity <qty> \ [--price <price>] \ [--source <source>] \ [--stock-name <name>] \ [--idempotency-key <key>] \ --json ``` Representative sensitive invocation from `leapcat-wallet/SKILL.md:55-65`: ```bash npx leapcat@0.1.1 wallet withdraw --amount <amount> --address <address> --json ``` The same execution pattern occurs throughout: - `SKILL.md:39-40,46-47,53-55,63` - `leapcat-auth/SKILL.md:13,23,34,49,57,65,73,81,89,97,105` - `leapcat-ipo/SKILL.md:13-14,25,33,44,56,68,79,87` - `leapcat-kyc/SKILL.md:13-14,24,40,48,56,64,77,85,93,101,110-111` - `leapcat-market/SKILL.md:13,23,35,48,61,73,81,89,101,109,117` - `leapcat-portfolio/SKILL.md:13-14,23,31` - `leapcat-trading/SKILL.md:13-14,25-34,54,66,77,85` - `leapcat-wallet/SKILL.md:13-15,25,33,41,49,60,72,80,88,96,107,114` ### Technical Analysis The project consists only of Skill documentation and does not include the implementation of the `leapcat` CLI. Every documented operation delegates execution to `npx leapcat@0.1.1`. When the package is not already available locally, `npx` can retrieve it from the configured npm registry and execute its package code. Pinning version `0.1.1` reduces uncontrolled version drift, but it does not establish the integrity or trustworthiness of that package version. The reviewed artifact contains no lockfile, expected package-tarball integrity h ...[truncated 2697 chars]
Remediation: ## Remediation Suggestions 1. **Vendor and audit the implementation** - Include the exact CLI source used by the Skill in the reviewed repository. - Build the executable from reviewed source rather than downloading executable code during each operation. 2. **Verify package integrity** - Publish and enforce the expected SHA-512 integrity value for the exact npm tarball. - Use a lockfile or controlled installation process that rejects artifacts whose integrity does not match. - Do not rely on a version number alone as an integrity control. 3. **Establish build provenance** - Sign release artifacts. - Publish verifiable provenance linking version `0.1.1` to a specific source commit and reproducible build. - Verify signatures and provenance before installation or execution. 4. **Avoid on-demand installation for sensitive commands** - Install the verified artifact in a separate administrative step. - Make financial commands use only that preverified local executable. - Disable lifecycle scripts where they are unnecessary. 5. **Restrict runtime privileges** - Run the CLI in a sandbox with access only to explicitly selected KYC files. - Restrict filesystem access to the minimum required configuration directory. - Restrict outbound network access to documented Leapcat API and upload endpoints. - Do not run the package with elevated operating-system privileges. 6. **Protect authentication material** - Replace plaintext token-file storage with operating-system-backed credential storage where possible. - Enforce owner-only permissions on any fallback token file. - Support rapid token revocation and session review. - Avoid exposing OTP codes, trade passwords, or tokens in command histories, logs, or JSON output. 7. **Add transaction confirmation controls** - Immediately before execution, require explicit user approval showing the final symbol, exchange, side, order type, quantity, price, estimated value, and fee ...[truncated 287 chars]

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Credential Access

High

Category: Privilege Escalation
Content: - All commands output JSON when using the `--json` flag - Session tokens are stored locally at `~/.config/leapcat/tokens.json` - Access tokens auto-refresh; re-login only needed after 30 days of inactivity - For sensitive operations (withdrawals), run `npx leapcat@0.1.1 auth reauth --json` first ## Security & Provenance
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: This skill instructs an agent to perform authentication, token refresh, re-authentication, and trade-password operations, but it gives no guidance on how sensitive artifacts such as OTPs, session tokens, refreshed credentials, or trade-password state should be protected. In an agent setting, that omission is risky because agents often log command invocations and JSON responses, which can leak credentials or enable session hijacking if tokens or authentication state are stored insecurely.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill documents `ipo subscribe` and `ipo cancel` as normal workflow steps without any explicit warning that these commands trigger real brokerage actions affecting the user's account and funds. In an agent context, this increases the risk of accidental order placement or cancellation, especially because the skill encourages direct command execution and notes only that the user 'may be prompted' for a trade password rather than requiring an explicit human confirmation checkpoint.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: This skill guides users through uploading identity documents and submitting personal information to a remote service, but it does not clearly warn that highly sensitive PII and document images will be transmitted off-host. Users may disclose passports, IDs, addresses, and other KYC data without informed consent or understanding of retention, privacy, and exposure risks, which is especially concerning because the workflow uses an auto-downloaded CLI via npx.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill repeatedly instructs users to run `npx leapcat@0.1.1 ...`, which will fetch and execute a package from the network, but it frames the commands as simple public read-only operations and does not clearly warn about that execution risk. This is dangerous because users may treat the skill as low risk market-data access while actually granting code execution to an externally hosted package that could be compromised, changed in the registry ecosystem, or execute unexpected postinstall/runtime behavior.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This skill enables direct placement and cancellation of live stock orders but does not include an explicit warning that trades can cause immediate financial loss, may execute at unfavorable market prices, and may be difficult or impossible to reverse once filled. In an agent context, the absence of strong caution and confirmation guidance increases the risk of accidental, misunderstood, or overly automated high-impact transactions.

Static analysis

No suspicious patterns detected.