ClawHub
Back to skill

Security audit

msx trade

Security checks for vulnerabilities and agentic risk

Overview

This MSX trading skill is purpose-aligned, but it can access sensitive financial data and perform live order actions with incomplete safeguards.

Review before installing. Use a restricted MSX API key if possible, confirm every order and cancellation manually, avoid broad requests like 'buy' or 'cancel' unless you clearly mean MSX trading, and be aware the skill may retrieve sensitive balances, positions, and transaction history.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

The cancel-order endpoint is exposed as a direct path-parameter action without documented safeguards requiring the agent to verify ownership of the order, restate the target order, and obtain explicit confirmation before cancellation. In a trading context, parameter misuse or confused-deputy behavior could cancel the wrong open order, directly affecting live financial positions and execution strategy.

Content

Scanner excerpt · api-orders.md (reported line 78)May include surrounding context.

DELETE /orders/{order_id} — Cancel an order

Request

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · api-orders.md (reported line 82)May include surrounding context.

Request

text
DELETE /orders/ORD-20250325-001
X-API-KEY: {MSX_API_KEY}

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

text

The key is stored in the environment variable `MSX_API_KEY`.  
Base URL: `https://api.msx.com/v1`

> ⚠️ Never expose, log, or repeat the API key in any response.  
> If `MSX_API_KEY` is missing, ask the user to set it before proceeding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The module documents direct access to sensitive financial profile, balance, and position data using only an API key, but it does not instruct the agent to warn the user, minimize data access, or confirm consent before retrieval. In a financial trading context, this increases privacy and confidentiality risk because the agent may fetch or display regulated financial information more readily than necessary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad enough to activate on generic account- or portfolio-related language, which can cause the skill to load in contexts the user did not clearly intend. Because this skill exposes financial account endpoints, accidental invocation increases the chance of unnecessary access to sensitive balance and holdings data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad enough to activate this finance/trading skill for generic requests like 'history', 'report', or 'transactions', which can cause the agent to enter a sensitive financial context unintentionally. In a trading skill, mistaken activation increases the chance of exposing account-specific trading or transaction data when the user may have meant something unrelated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This module describes direct access to sensitive financial history endpoints, including deposits, withdrawals, balances, and executed trades, but provides no privacy guardrails or warning that account data is sensitive. In the context of a security-token trading skill, this makes accidental over-disclosure more dangerous because the returned data can reveal assets, cash movements, and trading behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The listed triggers include generic terms such as "quote" and "price," plus broad market words in Chinese, without constraints or exclusion examples. This makes it unclear when the skill should activate versus when a user may simply be discussing prices or trends in a general sense.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger phrases include very broad terms like "buy", "sell", "order", and "cancel", which can cause this trading skill to activate in contexts where the user did not intend to trade. In a financial trading skill, unintended invocation is particularly risky because it can lead the agent into collecting order parameters or initiating high-impact transactional flows unnecessarily.

Content

No source excerpt is available for this finding.