Leapcat Skills

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:31 AM UTC
• Version: 0.1.1

Overview

The skill is coherent for Leapcat financial and KYC workflows, but it delegates live trading, withdrawals, IPO actions, and identity-data handling to an auto-downloaded npm CLI without enough confirmation or provenance safeguards.

Install only if you trust Leapcat and the exact npm package being executed. Before any trade, IPO subscription/cancel, wallet withdrawal, KYC agreement, or KYC submission, require an explicit user confirmation showing the final account, asset, quantity, price or amount, address, fees, and irreversible effects. Protect OTPs, trade passwords, and token files from logs or prompts, avoid running the CLI with elevated privileges, and prefer verified package installation or sandboxing for sensitive use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Auto-Downloaded npm CLI Executes Unreviewed Third-Party Code During Sensitive Operations

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:9
Vulnerability Type: Supply-chain exposure through automatic retrieval and execution of an unreviewed npm package
Risk Level: Medium

Vulnerable Code

markdown

A comprehensive set of 7 AI agent skills for the [Leapcat](https://leapcat.ai) platform. All commands use `npx leapcat@0.1.1` — no global install needed, just Node.js 18+.

Representative sensitive invocation from leapcat-trading/SKILL.md:20-34:

bash

npx leapcat@0.1.1 trading place-order \
  --symbol <symbol> \
  --exchange <exchange> \
  --side <BUY|SELL> \
  --order-type <LIMIT|MARKET> \
  --quantity <qty> \
  [--price <price>] \
  [--source <source>] \
  [--stock-name <name>] \
  [--idempotency-key <key>] \
  --json

Representative sensitive invocation from leapcat-wallet/SKILL.md:55-65:

bash

npx leapcat@0.1.1 wallet withdraw --amount <amount> --address <address> --json

The same execution pattern occurs throughout:

• SKILL.md:39-40,46-47,53-55,63
• leapcat-auth/SKILL.md:13,23,34,49,57,65,73,81,89,97,105
• leapcat-ipo/SKILL.md:13-14,25,33,44,56,68,79,87
• leapcat-kyc/SKILL.md:13-14,24,40,48,56,64,77,85,93,101,110-111
• leapcat-market/SKILL.md:13,23,35,48,61,73,81,89,101,109,117
• leapcat-portfolio/SKILL.md:13-14,23,31
• leapcat-trading/SKILL.md:13-14,25-34,54,66,77,85
• leapcat-wallet/SKILL.md:13-15,25,33,41,49,60,72,80,88,96,107,114

Technical Analysis

The project consists only of Skill documentation and does not include the implementation of the leapcat CLI. Every documented operation delegates execution to npx leapcat@0.1.1. When the package is not already available locally, npx can retrieve it from the configured npm registry and execute its package code.

Pinning version 0.1.1 reduces uncontrolled version drift, but it does not establish the integrity or trustworthiness of that package version. The reviewed artifact contains no lockfile, expected package-tarball integrity h ...[truncated 2697 chars]

Remediation

View remediation

Remediation Suggestions

1. Vendor and audit the implementation

   • Include the exact CLI source used by the Skill in the reviewed repository.
   • Build the executable from reviewed source rather than downloading executable code during each operation.

2. Verify package integrity

   • Publish and enforce the expected SHA-512 integrity value for the exact npm tarball.
   • Use a lockfile or controlled installation process that rejects artifacts whose integrity does not match.
   • Do not rely on a version number alone as an integrity control.

3. Establish build provenance

   • Sign release artifacts.
   • Publish verifiable provenance linking version 0.1.1 to a specific source commit and reproducible build.
   • Verify signatures and provenance before installation or execution.

4. Avoid on-demand installation for sensitive commands

   • Install the verified artifact in a separate administrative step.
   • Make financial commands use only that preverified local executable.
   • Disable lifecycle scripts where they are unnecessary.

5. Restrict runtime privileges

   • Run the CLI in a sandbox with access only to explicitly selected KYC files.
   • Restrict filesystem access to the minimum required configuration directory.
   • Restrict outbound network access to documented Leapcat API and upload endpoints.
   • Do not run the package with elevated operating-system privileges.

6. Protect authentication material

   • Replace plaintext token-file storage with operating-system-backed credential storage where possible.
   • Enforce owner-only permissions on any fallback token file.
   • Support rapid token revocation and session review.
   • Avoid exposing OTP codes, trade passwords, or tokens in command histories, logs, or JSON output.

7. Add transaction confirmation controls

   • Immediately before execution, require explicit user approval showing the final symbol, exchange, side, order type, quantity, price, estimated value, and fee ...[truncated 287 chars]

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

- All commands output JSON when using the `--json` flag
- Session tokens are stored locally at `~/.config/leapcat/tokens.json`
- Access tokens auto-refresh; re-login only needed after 30 days of inactivity
- For sensitive operations (withdrawals), run `npx leapcat@0.1.1 auth reauth --json` first

## Security & Provenance

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This skill instructs an agent to perform authentication, token refresh, re-authentication, and trade-password operations, but it gives no guidance on how sensitive artifacts such as OTPs, session tokens, refreshed credentials, or trade-password state should be protected. In an agent setting, that omission is risky because agents often log command invocations and JSON responses, which can leak credentials or enable session hijacking if tokens or authentication state are stored insecurely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill documents ipo subscribe and ipo cancel as normal workflow steps without any explicit warning that these commands trigger real brokerage actions affecting the user's account and funds. In an agent context, this increases the risk of accidental order placement or cancellation, especially because the skill encourages direct command execution and notes only that the user 'may be prompted' for a trade password rather than requiring an explicit human confirmation checkpoint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This skill guides users through uploading identity documents and submitting personal information to a remote service, but it does not clearly warn that highly sensitive PII and document images will be transmitted off-host. Users may disclose passports, IDs, addresses, and other KYC data without informed consent or understanding of retention, privacy, and exposure risks, which is especially concerning because the workflow uses an auto-downloaded CLI via npx.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill repeatedly instructs users to run npx leapcat@0.1.1 ..., which will fetch and execute a package from the network, but it frames the commands as simple public read-only operations and does not clearly warn about that execution risk. This is dangerous because users may treat the skill as low risk market-data access while actually granting code execution to an externally hosted package that could be compromised, changed in the registry ecosystem, or execute unexpected postinstall/runtime behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This skill enables direct placement and cancellation of live stock orders but does not include an explicit warning that trades can cause immediate financial loss, may execute at unfavorable market prices, and may be difficult or impossible to reverse once filled. In an agent context, the absence of strong caution and confirmation guidance increases the risk of accidental, misunderstood, or overly automated high-impact transactions.

Content

No source excerpt is available for this finding.