ClawHub
Back to skill

Security audit

msx trade

Security checks for vulnerabilities and agentic risk

Overview

This MSX trading skill is purpose-aligned, but it can access sensitive financial data and perform live order actions with incomplete safeguards.

Review before installing. Use a restricted MSX API key if possible, confirm every order and cancellation manually, avoid broad requests like 'buy' or 'cancel' unless you clearly mean MSX trading, and be aware the skill may retrieve sensitive balances, positions, and transaction history.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
---

## DELETE /orders/{order_id} — Cancel an order

**Request**
```
Confidence
80% confidence
Finding
The cancel-order endpoint is exposed as a direct path-parameter action without documented safeguards requiring the agent to verify ownership of the order, restate the target order, and obtain explicit confirmation before cancellation. In a trading context, parameter misuse or confused-deputy behavior could cancel the wrong open order, directly affecting live financial positions and execution strategy.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
**Request**
```
DELETE /orders/ORD-20250325-001
X-API-KEY: {MSX_API_KEY}
```
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

External Transmission

Medium
Category
Data Exfiltration
Content
```

The key is stored in the environment variable `MSX_API_KEY`.  
Base URL: `https://api.msx.com/v1`

> ⚠️ Never expose, log, or repeat the API key in any response.  
> If `MSX_API_KEY` is missing, ask the user to set it before proceeding.
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The module documents direct access to sensitive financial profile, balance, and position data using only an API key, but it does not instruct the agent to warn the user, minimize data access, or confirm consent before retrieval. In a financial trading context, this increases privacy and confidentiality risk because the agent may fetch or display regulated financial information more readily than necessary.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger phrases are broad enough to activate on generic account- or portfolio-related language, which can cause the skill to load in contexts the user did not clearly intend. Because this skill exposes financial account endpoints, accidental invocation increases the chance of unnecessary access to sensitive balance and holdings data.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger phrases are broad enough to activate this finance/trading skill for generic requests like 'history', 'report', or 'transactions', which can cause the agent to enter a sensitive financial context unintentionally. In a trading skill, mistaken activation increases the chance of exposing account-specific trading or transaction data when the user may have meant something unrelated.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
This module describes direct access to sensitive financial history endpoints, including deposits, withdrawals, balances, and executed trades, but provides no privacy guardrails or warning that account data is sensitive. In the context of a security-token trading skill, this makes accidental over-disclosure more dangerous because the returned data can reveal assets, cash movements, and trading behavior.

Vague Triggers

Medium
Confidence
96% confidence
Finding
The listed triggers include generic terms such as "quote" and "price," plus broad market words in Chinese, without constraints or exclusion examples. This makes it unclear when the skill should activate versus when a user may simply be discussing prices or trends in a general sense.

Vague Triggers

Medium
Confidence
97% confidence
Finding
The trigger phrases include very broad terms like "buy", "sell", "order", and "cancel", which can cause this trading skill to activate in contexts where the user did not intend to trade. In a financial trading skill, unintended invocation is particularly risky because it can lead the agent into collecting order parameters or initiating high-impact transactional flows unnecessarily.

Static analysis

No suspicious patterns detected.