TradingView Signal Parser

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:50 AM UTC
• Version: 1.0.1

Overview

This paid trading parser mostly does what it claims for text signals, but it exposes a billing API key and automatically charges users even for advertised URL parsing that is not actually implemented.

Review this carefully before installing. The skill can trigger external billing calls and exposes its billing API key in the package, which should be rotated and removed. Do not rely on the advertised TradingView URL support unless fixed, because URL-only use appears billable but nonfunctional.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:13
• Finding: Hard-Coded Billing API Credential Exposed in Source Code## Vulnerability Details **File Location**: `index.js:13-17` **Vulnerability Type**: Hard-coded secret / exposed API credential **Risk Level**: Medium ### Vulnerable Code ```js // SkillPay Configuration const BILLING_URL = 'https://skillpay.me/api/v1/billing'; const API_KEY = 'sk_4312778b58aa7c81c15bd0e2b4fe544e12ca9e765f0deab630a50ecd4daf4ac2'; const SKILL_ID = '1481cef0-2cd0-4768-83d9-a51c57a46180'; const headers = { 'X-API-Key': API_KEY, 'Content-Type': 'application/json' }; ``` The same credential is additionally disclosed in `SKILL.md:23-26`: ```markdown ## Integration - Billing: SkillPay.me - API Key: sk_4312778b58aa7c81c15bd0e2b4fe544e12ca9e765f0deab630a50ecd4daf4ac2 ``` ### Technical Analysis A reusable billing API credential is stored in plaintext in executable source code and duplicated in project documentation. Any party that can download, inspect, or redistribute the package can recover the credential without needing runtime access. The code uses this shared secret as the `X-API-Key` header when submitting billing requests: ```js const { data } = await axios.post(BILLING_URL + '/charge', { user_id: userId, skill_id: SKILL_ID, amount: 1, }, { headers }); ``` If the remote service treats possession of this key as sufficient authorization, an attacker can reproduce requests independently of the skill. The exact operations and privileges available to the key depend on server-side controls and cannot be established from the audited repository alone. ### Attack Path 1. Obtain the published project or inspect its documentation. 2. Extract the plaintext API key from `index.js` or `SKILL.md`. 3. Construct requests to the SkillPay billing API with the exposed value in the `X-API-Key` header. 4. Attempt operations permitted to that credential, including forged charge requests using attacker-selected user identifiers or skill identifiers. 5. Repeat requests to consume quota, ma ...[truncated 692 chars]
• Remediation: ## Remediation Suggestions 1. Revoke and rotate the exposed API key immediately. 2. Remove the credential from `index.js`, `SKILL.md`, package artifacts, examples, logs, and version-control history. 3. Load the credential at runtime from a protected secret manager or environment variable, and fail securely when it is unavailable. 4. Do not distribute a shared privileged credential to skill consumers. Prefer narrowly scoped, short-lived, per-installation credentials. 5. Restrict the replacement credential to the minimum required billing operation and skill identity. 6. Enforce server-side authorization so callers cannot select arbitrary users, amounts, or skill identifiers merely by possessing an API key. 7. Add request signing, timestamps, nonces, replay protection, rate limits, and anomaly monitoring for billing operations. 8. Review billing logs for use of the disclosed credential and investigate unexpected requests. 9. Add automated secret scanning to source-control and release pipelines to prevent recurrence.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Natural-Language Policy Violations

High

• Confidence: 99% confidence
• Finding: A hard-coded API key is exposed directly in documentation, which can allow unauthorized parties to use the associated external service, incur charges, or access linked account capabilities. Because the key is published in a skill file, it is effectively compromised immediately and may also indicate poor secret-management practices elsewhere.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The lockfile pins axios 1.13.6, and the static analysis indicates multiple published advisories affecting this version, including SSRF-related proxy bypass and prototype-pollution-based request/credential compromise scenarios. Because this project appears to be a trading signal skill that likely makes outbound HTTP requests, a vulnerable HTTP client is directly relevant and can increase risk of SSRF, credential leakage, redirect abuse, or traffic interception depending on how the package is used.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: The lockfile includes form-data 4.0.5, which is flagged for CRLF injection via unescaped multipart field names and filenames. If any part of the application builds multipart requests from untrusted input, an attacker may be able to inject crafted headers or manipulate request structure, potentially leading to request smuggling or downstream parser confusion.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: The skill depends on axios 1.13.6, which is flagged with multiple known advisories, including issues that can enable SSRF, credential theft, response hijacking, and prototype-pollution-related abuse. In a network-capable parsing skill, a vulnerable HTTP client is especially dangerous because it may process untrusted URLs, proxies, or remote responses as part of normal operation.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill documents an external billing/integration service but does not warn users that submitted TradingView URLs or signal text may be transmitted to third-party systems during request handling or payment-related flows. In a trading context, signals, positions, and strategy details can be sensitive business data, so lack of disclosure creates privacy and data-handling risk even if no overt exfiltration logic is shown in the file.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The top-level doc comment describes the skill as parsing TradingView signals and taking an optional TradingView URL, implying the URL is part of the supported analysis flow. However, when only a URL is provided, the handler returns a stub object with 'URL_DETECTED' and a note asking for signal text rather than actually parsing the URL.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill performs an external billing action unrelated to the core parsing logic and does so automatically before completing analysis. In this context, that creates financial-risk behavior and expands the trust boundary to a third-party payment service, which is dangerous because users may be charged unexpectedly and the skill can exfiltrate usage-linked data during normal operation.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The skill contains a hardcoded live-looking API key for a billing service and uses it to perform paid external actions without adequate disclosure. This is dangerous because embedded secrets can be extracted and abused by anyone with code access, leading to unauthorized billing activity, account compromise, or fraudulent charges against the operator.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The billing request sends the user identifier to an external service without any visible consent or notice at execution time. This is dangerous because it leaks user-linked data to a third party and creates a privacy/compliance risk, especially since the transfer happens as a prerequisite to using a simple parsing feature.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: The lockfile includes follow-redirects 1.15.11, which is flagged for leaking custom authentication headers across cross-domain redirects. In a skill that may contact third-party endpoints, this can expose API keys, bearer tokens, or internal credentials if a malicious or compromised endpoint returns a redirect to an attacker-controlled domain.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "ISC",
  "description": "Parse TradingView signals and provide structured analysis",
  "dependencies": {
    "axios": "^1.13.6"
  }
}

• Confidence: 95% confidence
• Finding: The dependency is version-ranged with a caret, which allows installation of newer 1.x releases without an explicit review or lock to a vetted version. This increases supply-chain risk and can cause builds to pull in unexpected code or newly introduced vulnerabilities over time.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: index.js:17

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:26