Crypto Auto Trader

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:12 AM UTC
• Version: 1.0.0

Overview

This crypto auto-trading skill asks users to configure exchange API keys and run a long-lived trading bot without enough safety, credential, or dependency guidance.

Review this carefully before installing. Use only exchange API keys with withdrawal disabled, minimal trading permissions, and exchange-side protections such as IP allowlisting or subaccounts. Do not place real keys in a tracked config file, avoid running the bot on funds you cannot lose, and require a reviewed lockfile and clear start/stop controls before live use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:48
• Finding: Plaintext Storage of Exchange API Credentials## Vulnerability Details **File Location**: `SKILL.md`, line 48 **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: High **Complete Vulnerable Snippet**: ```text 2. Edit `config.json` and enter your API Key. ``` The snippet above is an English rendering of the instruction at line 48, which directs users to place an API key in `config.json`. ### Technical Analysis The deployment instructions direct users to store cryptocurrency exchange API credentials in a plaintext JSON configuration file. No corresponding controls are documented for: - Excluding `config.json` from version control. - Restricting filesystem permissions. - Loading credentials from environment variables or a secret manager. - Limiting the API key to trading-only permissions. - Disabling withdrawal permissions. - Applying an exchange-side IP allowlist. - Preventing credentials from appearing in backups or support archives. A plaintext configuration file can be exposed through an accidental source-control commit, shared project archive, cloud backup, overly permissive filesystem access, or local system compromise. The repository does not include the referenced `config.json` or application source, so runtime handling of the credential could not be verified. ### Attack Path 1. A user follows the deployment instructions and writes an exchange API key into `config.json`. 2. The configuration file is accidentally committed, archived, backed up, shared, or read by another local process or user. 3. An attacker extracts the API key and any associated secret from the file. 4. The attacker authenticates to the relevant exchange API. 5. The attacker performs actions allowed by the key, potentially including account-data access or unauthorized trades. Withdrawal is possible only if the exposed key was independently granted withdrawal permission. ### Impact Assessment The maximum impact is bounded by the permissions assigned ...[truncated 326 chars]
• Remediation: ## Remediation Suggestions - Load credentials from environment variables or a dedicated secret manager rather than a tracked JSON file. - Provide a sanitized `config.example.json` containing placeholders only. - Add `config.json`, `.env`, and other secret-bearing files to `.gitignore`. - Validate at startup that placeholder or empty credentials are not accepted. - Restrict secret-file permissions to the service account, such as mode `0600` on supported systems. - Require exchange API keys to use least privilege, with withdrawal permissions disabled. - Recommend exchange-side IP allowlisting and separate keys for development and production. - Document credential rotation and immediate revocation procedures. - Ensure secrets are redacted from logs, exceptions, diagnostics, backups, and Telegram alerts.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43
• Finding: Unpinned and Non-Reproducible Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 43 and 49 **Vulnerability Type**: Unpinned third-party dependencies and missing lockfile **Risk Level**: Medium **Complete Vulnerable Snippets**: ```bash npm install ccxt https-proxy-agent ``` ```text npm install ``` ### Technical Analysis The installation instructions request npm packages without fixed versions. The audited project contains no `package.json`, lockfile, integrity metadata, or dependency-review policy. Consequently, installations are not reproducible and may resolve to package or transitive-dependency versions that differ from those originally reviewed. npm installation may also execute package lifecycle scripts with the privileges of the user running the command. If a future package release or transitive dependency is compromised, malicious installation logic could run locally. The package names shown are not visibly misspelled, and no untrusted registry or confirmed malicious package was identified; this finding concerns unsafe dependency management rather than proven package compromise. ### Attack Path 1. A user follows the documented command without a reviewed lockfile. 2. npm resolves the latest versions satisfying its default resolution behavior, including transitive dependencies. 3. A dependency version published after the project documentation was reviewed is downloaded. 4. If that release or one of its transitive dependencies is compromised, npm installs the malicious content and may run its lifecycle scripts. 5. Malicious code executes with the filesystem, network, and process privileges of the user who ran npm. ### Impact Assessment A compromised dependency or lifecycle script could read files available to the installing user, access environment variables, inspect plaintext exchange configuration, make outbound network requests, modify project files, or establish execution through the installed application. The precise impac ...[truncated 156 chars]
• Remediation: ## Remediation Suggestions - Include a reviewed `package.json` with explicit compatible dependency versions. - Generate and commit a lockfile so direct and transitive dependency versions and integrity hashes are fixed. - Replace generic installation instructions with `npm ci`, which enforces the lockfile. - Review dependency provenance, maintainers, release history, and known advisories before updating. - Use automated vulnerability scanning and controlled dependency-update review. - Avoid running npm with administrator or root privileges. - Consider disabling lifecycle scripts during initial verification with `npm ci --ignore-scripts`, then explicitly enable only required scripts after review. - Document the expected npm registry and reject unexpected registry overrides. - Remove `https-proxy-agent` if the application does not require it, thereby reducing supply-chain exposure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs users to place exchange API credentials directly into a local config.json file while providing no guidance on secure storage, least-privilege API scopes, IP whitelisting, or the consequences of automated live trading. In a crypto auto-trading context, exposed or mishandled keys can lead directly to unauthorized trading activity and financial loss, making the omission materially risky even though it is framed as setup guidance.

Static analysis

No suspicious patterns detected.