xcard-trading

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:28 AM UTC
• Version: 1.0.0

Overview

This is a coherent XCard trading skill, but it needs Review because it can access private financial data and change trading orders with broad activation and incomplete safeguards.

Install only if you intend to let an agent use your personal XCard API key for financial account access and trading actions. Prefer a scoped or revocable API key, verify trading permissions, and treat account/history responses as private. Before installation, the publisher should narrow triggers to explicit XCard trading intent, require confirmation for canceling orders, and add privacy/confirmation guidance before showing account balances, positions, or transaction history.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

---

## DELETE /orders/{order_id} — Cancel an order

**Request**
```

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**Request**
```
DELETE /orders/ORD-20250325-001
X-API-KEY: {XCard_API_KEY}
```

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

External Transmission

Medium

• Category: Data Exfiltration

Content

```

The key is stored in the environment variable `XCARD_API_KEY`.  
Base URL: `https://api.xcard.com/v1`

> ⚠️ Never expose, log, or repeat the API key in any response.  
> If `XCARD_API_KEY` is missing, ask the user to set it before proceeding.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrases are broad enough to activate on generic finance-related terms like 'balance', 'portfolio', '账户', or '资产', which can cause this skill to load in conversations not clearly intended for XCard trading. In a financial skill that exposes account and holdings endpoints, over-triggering increases the chance of unnecessary handling or disclosure of sensitive account context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This module retrieves sensitive financial data including profile details, cash balances, and portfolio positions, but it provides no user-facing privacy notice, consent step, or verification guidance before access. In the context of a trading skill, this makes accidental exposure more dangerous because highly sensitive financial information could be surfaced too readily in response to ambiguous or shared-device interactions.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes generic terms like "history," "report," "transactions," and common Chinese equivalents that can match many unrelated user requests. In an agent setting, this can cause the trading skill to activate outside clear financial intent, increasing the chance of exposing sensitive trading or account-history functions when the user did not explicitly request XCard data.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This section exposes highly sensitive financial records, including deposits, withdrawals, balances, and trade settlement details, but provides no user-facing privacy or consent guidance. In a conversational agent, that omission increases the risk of revealing private financial history to the wrong person, in the wrong context, or without sufficient confirmation.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger list includes generic terms like "quote" and "price," which are common in everyday requests and could cause unintended activation outside the intended market-data context. The file does not provide exclusion conditions or negative examples to clarify when these triggers should not invoke the skill.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The listed triggers include very common words such as "buy", "sell", "order", and "cancel", which frequently appear in everyday conversation outside the intended trading context. The file does not provide narrowing conditions, exclusions, or negative examples to distinguish financial order intent from general language use.

Static analysis

No suspicious patterns detected.