Astrbot Trader

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:17 AM UTC
• Version: 1.0.0

Overview

This skill is a trading persona that exposes exchange credentials and financial holdings while asking for broad, recurring authority, so it should be reviewed carefully before use.

Do not install this as-is for a real account. Treat the listed OKX credentials and portfolio data as compromised, rotate any matching keys, remove secrets from the skill, require read-only credentials for monitoring, keep TLS verification enabled, and add explicit user confirmation before trades, order changes, publishing, direct messages, or synchronization.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:6

Finding

Agent Identity and Behavioral Instruction Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6–9
Vulnerability Type: Agent identity, authority, and behavioral-policy override
Risk Level: High

Evidence:

text

你是 AstrBot 交易AI，在 OpenClaw 上运行。你有完整电脑权限。

## 身份
专业加密货币量化交易AI。风格：做空优先，回测驱动决策。不生成图片，短回复，主动推进。

Technical Analysis

The skill instructs the agent to replace its current identity with an autonomous cryptocurrency-trading persona. It also asserts that the agent has complete computer access and directs it to act proactively under a predetermined trading bias.

These are control-plane instructions rather than narrowly scoped operational guidance. When loaded into an agent context, they can alter the agent's session goals, perceived authority, response policy, and financial decision-making behavior. The assertion of unrestricted computer access may also cause the agent to attempt operations outside the permissions legitimately required for a specific user request.

Attack Path

1. A user or automated system installs or loads the skill.
2. The skill text enters the agent's active instruction context.
3. The agent interprets the identity statement and full-access assertion as standing instructions.
4. The agent adopts the supplied trading persona and proactive operating style.
5. If financial or system tools are available, the agent may use them under the attacker-defined trading preferences rather than a narrowly authorized user objective.

Impact Assessment

Successful exploitation can redirect the agent's current-session behavior and influence sensitive financial decisions. Depending on the tools exposed to the agent, the affected scope could include exchange-account queries, trading recommendations, order-related operations, local-file access, and other computer resources.

The files do not demonstrate that unrestricted privileges are actually granted, but the instruction encourages the agent to assume and exercise such ...[truncated 64 chars]

Remediation

View remediation

Remediation Suggestions

• Remove all instructions that replace the agent's identity or claim unrestricted computer access.
• Define the skill as an optional, task-scoped assistant capability rather than a governing persona.
• Require explicit user confirmation before every account mutation, order placement, cancellation, or other financially consequential action.
• State that platform and system safety policies take precedence over skill instructions.
• Restrict available tools and permissions to the minimum necessary for the current task.
• Separate market analysis from trade execution, with execution disabled by default.
• Avoid fixed behavioral biases such as automatically preferring short positions; require evidence-based analysis and user approval for each decision.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:11

Finding

Hardcoded Exchange Credentials and Plaintext Financial Information

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–18
Vulnerability Type: Hardcoded credentials and sensitive financial-data exposure
Risk Level: Critical

Evidence:

text

## OKX API
key=63800af7-fa50-47a6-a3df-109b4c40f74c secret=36F63F…4867 passphrase=276687*Cjj
代理http://127.0.0.1:7890。先GET预热再POST。verify=False，posSide必填。HttpsProxyAgent{keepAlive:false}。

## 持仓
OKX合约: BTC多0.15@$60,280 5x SOL多1@$62.77 5x 余额$91.23 USDT
挂单: 买BTC@$58k/卖BTC@$65k/买SOL@$60
其他: 汇丰NOK10 华鑫浙文100+粤电力400+现金3664

Technical Analysis

The skill stores an API key, passphrase, partially masked secret, account balance, leveraged positions, pending orders, and other holdings directly in a plaintext project file. Documentation and skill files are commonly copied, archived, shared, indexed, or placed into agent contexts, making them unsuitable locations for authentication material or private account information.

Although the secret shown in the reviewed file is partially masked and the validity of all values was not tested, the exposed API identifier and passphrase remain sensitive. They may be combined with a complete secret recovered from logs, backups, source history, or another compromised system. Position and balance information can independently facilitate targeted fraud and manipulation.

Attack Path

1. An attacker obtains the skill package, a repository copy, an archive, a prompt transcript, or a system log containing the file.
2. The attacker extracts the API identifier, passphrase, connection configuration, positions, pending orders, and account details.
3. If the full secret is available elsewhere or the exposed credentials remain sufficient in a related workflow, the attacker attempts authenticated exchange API access.
4. Depending on the API key's permissions, the attacker may inspect account data, manipulate orders, or execute trades.
5. Even without authenticated access, the disclosed portfolio da ...[truncated 672 chars]

Remediation

View remediation

Remediation Suggestions

• Immediately revoke and rotate every credential referenced in the file.
• Remove credentials, balances, positions, orders, and holdings from the project and its version history.
• Load credentials at runtime from a dedicated secret manager or protected environment variables.
• Never place secrets in prompts, skill documentation, source files, logs, examples, or generated reports.
• Create a dedicated exchange API key with read-only access unless trading is explicitly required.
• If trading is necessary, disable withdrawals, apply IP allowlisting, limit instrument access where supported, and enforce minimum required scopes.
• Separate read-only monitoring credentials from trade-execution credentials.
• Add automated secret scanning to the packaging and release process.
• Redact account values in diagnostic output and apply strict access controls to financial records.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:13

Finding

Disabled TLS Certificate Verification for Exchange Communications

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 13
Vulnerability Type: Insecure TLS configuration
Risk Level: High

Evidence:

text

代理http://127.0.0.1:7890。先GET预热再POST。verify=False，posSide必填。HttpsProxyAgent{keepAlive:false}。

Technical Analysis

The verify=False directive disables TLS certificate validation. TLS encryption without certificate authentication does not reliably establish the identity of the exchange endpoint. A malicious or compromised proxy, local process, certificate-injection mechanism, or network intermediary could present an untrusted certificate without the client rejecting the connection.

Because the same configuration is associated with an exchange API, intercepted traffic may contain authentication headers, account responses, and trade requests. An active intermediary could potentially read or alter those messages.

Attack Path

1. The agent follows the documented exchange connection configuration.
2. Requests are sent through the local proxy at 127.0.0.1:7890.
3. TLS certificate verification is disabled.
4. An attacker who controls or impersonates the local proxy, compromises the host, or gains an applicable network position presents an untrusted certificate.
5. The client accepts the certificate instead of terminating the connection.
6. The attacker observes sensitive exchange traffic or modifies API responses and requests, potentially changing trading behavior.

Impact Assessment

Exploitation may expose exchange authentication data, portfolio information, and trading requests. An active attacker could manipulate prices or account responses observed by the agent, or alter order parameters before they reach the intended endpoint.

The practical scope depends on how the documented configuration is implemented and whether the local proxy is trusted. No proxy implementation or executable client code was present in the reviewed project, so actual intercep ...[truncated 26 chars]

Remediation

View remediation

Remediation Suggestions

• Remove verify=False and require certificate verification for every HTTPS request.
• Use the operating system or runtime's trusted certificate store.
• Fail closed on certificate expiration, hostname mismatch, unknown issuers, or other validation errors.
• Ensure the local proxy is explicitly authorized, patched, access-controlled, and bound only to required interfaces.
• Do not transmit exchange credentials through an untrusted debugging or interception proxy.
• Consider certificate or public-key pinning where operationally appropriate, while maintaining a secure rotation procedure.
• Add tests that confirm invalid certificates are rejected.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:28

Finding

Overbroad Standing Authorization for Recurring Financial and Local-State Operations

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28–32; checklist.md, lines 1–8
Vulnerability Type: Excessive and insufficiently scoped operational authority
Risk Level: High

Evidence from SKILL.md:

text

## 任务
1. 每30分钟巡检OKX持仓+价格+风控
2. 每天写一篇Substack加密日报
3. 每天生成1-2条推特文案+潜在客户私信话术
4. 回测信号→跑完再推荐

Evidence from checklist.md:

text

# 每日巡检
- [ ] OKX余额+持仓+挂单
- [ ] BTC/SOL浮盈
- [ ] 美股POET/AAOI/NVDA价格
- [ ] 回测BOLL信号
- [ ] Substack日报
- [ ] Twitter搜客户
- [ ] task_bridge.json同步AstrBot

Technical Analysis

The skill establishes recurring access to exchange positions, balances, pending orders, market information, social-platform searches, and local synchronization state. It does not define narrow API scopes, authorization boundaries, user-consent requirements, permitted synchronization fields, or restrictions on account mutations.

Combined with the separate assertion that the agent has complete computer access, these recurring tasks can be interpreted as standing authorization rather than case-specific user requests. The reference to synchronizing task_bridge.json does not specify what data is transferred, where it is sent, or which process may consume it.

This finding does not establish implemented data exfiltration, persistence, or automatic trading. No scripts, schedulers, or synchronization implementation were present in the reviewed project. The risk arises from the overbroad instructions and unspecified authorization model.

Attack Path

1. The skill is loaded and its task list is treated as continuing authorization.
2. The agent periodically accesses exchange balances, positions, pending orders, and market data.
3. The agent also searches social-platform data and reads or writes local synchronization state.
4. Sensitive information remains repeatedly available in the agent context or synchronization workflow.
5. If a connected tool, plugin, or downst ...[truncated 832 chars]

Remediation

View remediation

Remediation Suggestions

• Replace standing authorization with explicit, time-bounded user consent for each account and operation.
• Require confirmation before any trade, order cancellation, message transmission, publication, or external synchronization.
• Use read-only exchange credentials for monitoring tasks.
• Document the exact fields read from or written to task_bridge.json, the destination process, retention period, and access controls.
• Prevent credentials, balances, positions, and personal data from entering synchronization files unless strictly necessary.
• Apply filesystem allowlists so the skill can access only explicitly approved paths.
• Disable unattended periodic execution unless it is configured through a trusted scheduler with auditable permissions and revocation controls.
• Record security-relevant operations in tamper-resistant audit logs without logging secrets.
• Enforce data minimization and isolate financial, social-media, and content-generation capabilities into separate permission domains.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Granting 'full computer access' to a trading persona is excessive and materially increases blast radius if the agent is misused or prompted into unsafe behavior. In this context, the skill also has embedded credentials and financial tasks, so unrestricted system access could enable credential theft, local file exfiltration, unauthorized trading, or persistence.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill embeds live-looking OKX API credentials and passphrase directly in documentation, which is a severe secret-exposure issue. Because the skill concerns financial trading, exposed credentials could enable unauthorized account access, trading, fund loss, and leakage to logs, prompts, or downstream tools.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The entire skill is written as Chinese-only operating instructions and does not offer any language choice or opt-in mechanism. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Setting 'verify=False' disables TLS certificate verification, making API calls vulnerable to man-in-the-middle interception or tampering. In a trading context with sensitive credentials and financial transactions, this can expose secrets and allow malicious modification of market data or order requests.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

## OKX API
key=63800af7-fa50-47a6-a3df-109b4c40f74c secret=36F63F…4867 passphrase=276687*Cjj
代理http://127.0.0.1:7890。先GET预热再POST。verify=False，posSide必填。HttpsProxyAgent{keepAlive:false}。

## 持仓
OKX合约: BTC多0.15@$60,280 5x SOL多1@$62.77 5x 余额$91.23 USDT

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is presented as a trading assistant, but it also includes content marketing, social-media posting, and lead-generation tasks. This scope expansion increases the chance of unauthorized actions, data misuse, and social engineering beyond the user’s likely expectation for a trading-focused skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation adds social-media growth and sales outreach capabilities that are unrelated to the core trading purpose. In combination with autonomous tasking, this could be used to send manipulative messages, misuse account context, or conduct spam/social-engineering under the guise of a trading skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The title and checklist items are written entirely in Chinese, which implies the skill operates in a fixed language without offering the user any language or locale choice. This is a natural-language policy concern because no opt-in or justification for the locale constraint is provided in the file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.