Security audit

msx-trading

Security checks for vulnerabilities and agentic risk

Overview

This trading skill is mostly coherent, but it can access sensitive financial data and cancel trading orders with broad triggers and incomplete confirmation guidance.

Install only if you trust the MSX integration and are comfortable giving the agent an API key that can view financial account data and perform trading actions. Before use, require explicit confirmation for cancellations as well as new orders, and use precise MSX-specific requests when asking for account or history data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tool Parameter Abuse

High

Category: Tool Misuse
Content: --- ## DELETE /orders/{order_id} — Cancel an order **Request** ```
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: **Request** ``` DELETE /orders/ORD-20250325-001 X-API-KEY: {MSX_API_KEY} ```
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

External Transmission

Medium

Category: Data Exfiltration
Content: ``` The key is stored in the environment variable `MSX_API_KEY`. Base URL: `https://api.msx.com/v1` > ⚠️ Never expose, log, or repeat the API key in any response. > If `MSX_API_KEY` is missing, ask the user to set it before proceeding.
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger phrases and load condition are broad enough to activate on generic terms like 'account', 'balance', or 'portfolio', which may cause this trading skill to load in conversations not clearly requesting brokerage actions. In a financial context, accidental activation increases the chance of exposing or retrieving sensitive account data when the user intended a different service or context.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The file documents direct access to profile, balance, and holdings data using an API key but provides no privacy notice, consent check, or guidance on safe handling of sensitive financial information. In a trading skill, this omission is dangerous because account balances, positions, and identity-linked profile data are highly sensitive and could be retrieved or displayed without adequate user awareness or minimization.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger phrases are broad enough to activate this skill for generic terms like 'history', 'report', or 'transactions', which can cause the agent to surface or fetch highly sensitive trading and account records when the user may have meant something else. In a financial-trading context, accidental invocation increases the risk of unnecessary access to private data and overbroad disclosure in conversation.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This section documents endpoints that expose detailed account cash flows, executed trades, and order history, but it provides no warning that the returned data is sensitive financial information. Without explicit cautioning, an agent may present or retrieve this information too readily, increasing the chance of privacy violations, oversharing, or disclosure to someone with ambiguous or unintended access.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger phrase list includes very broad English terms such as 'order' and 'cancel', which are common in non-trading conversations. In a trading skill that can place or cancel orders, unintended activation increases the risk that the agent enters an order-management flow without sufficiently clear user intent, potentially leading to accidental transactional actions.

Natural-Language Policy Violations

Low

Confidence: 79% confidence
Finding: The skill hard-codes both Chinese and English trigger phrases, but it does not explain how language selection is determined or offer user opt-in for a preferred language/locale. This can create an implicit language policy decision instead of clearly letting the user choose.

Static analysis

No suspicious patterns detected.