Security audit
Security checks for vulnerabilities and agentic risk
This trading skill is mostly coherent, but it can access sensitive financial data and cancel trading orders with broad triggers and incomplete confirmation guidance.
Install only if you trust the MSX integration and are comfortable giving the agent an API key that can view financial account data and perform trading actions. Before use, require explicit confirmation for cancellations as well as new orders, and use precise MSX-specific requests when asking for account or history data.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Request
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Request
DELETE /orders/ORD-20250325-001
X-API-KEY: {MSX_API_KEY}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
The key is stored in the environment variable `MSX_API_KEY`.
Base URL: `https://api.msx.com/v1`
> ⚠️ Never expose, log, or repeat the API key in any response.
> If `MSX_API_KEY` is missing, ask the user to set it before proceeding.
The trigger phrases and load condition are broad enough to activate on generic terms like 'account', 'balance', or 'portfolio', which may cause this trading skill to load in conversations not clearly requesting brokerage actions. In a financial context, accidental activation increases the chance of exposing or retrieving sensitive account data when the user intended a different service or context.
The file documents direct access to profile, balance, and holdings data using an API key but provides no privacy notice, consent check, or guidance on safe handling of sensitive financial information. In a trading skill, this omission is dangerous because account balances, positions, and identity-linked profile data are highly sensitive and could be retrieved or displayed without adequate user awareness or minimization.
The trigger phrases are broad enough to activate this skill for generic terms like 'history', 'report', or 'transactions', which can cause the agent to surface or fetch highly sensitive trading and account records when the user may have meant something else. In a financial-trading context, accidental invocation increases the risk of unnecessary access to private data and overbroad disclosure in conversation.
This section documents endpoints that expose detailed account cash flows, executed trades, and order history, but it provides no warning that the returned data is sensitive financial information. Without explicit cautioning, an agent may present or retrieve this information too readily, increasing the chance of privacy violations, oversharing, or disclosure to someone with ambiguous or unintended access.
The trigger phrase list includes very broad English terms such as 'order' and 'cancel', which are common in non-trading conversations. In a trading skill that can place or cancel orders, unintended activation increases the risk that the agent enters an order-management flow without sufficiently clear user intent, potentially leading to accidental transactional actions.
The skill hard-codes both Chinese and English trigger phrases, but it does not explain how language selection is determined or offer user opt-in for a preferred language/locale. This can create an implicit language policy decision instead of clearly letting the user choose.