SimianX AI

• Outcome: Review
• Latest audit: Oct 16, 2026 · 6:23 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent SimianX market-analysis integration, but it asks agents to trust mutable remote instructions and can create overly broad account API keys.

Install only if you are comfortable giving an agent durable SimianX API access. Prefer browser-link sign-in where you can review scopes, or explicitly request only data:read and analysis:run for ordinary analysis. Avoid allowing the agent to follow remote SKILL.md updates automatically, and require confirmation before autopilot, follow, key-management, or paper-position changes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:50

Finding

Automatic Trust of Mutable Remote Skill Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:50-55
Vulnerability Type: Unverified remote instruction substitution
Risk Level: High

Vulnerable Snippet

markdown

0. **Version check, once per session.** This file is version `1.0.2` (frontmatter `metadata.version`). Send
   `X-SimianX-Skill: 1.0.2` on every request. Before the first real call, `GET /v1/skill` (public): if `data.version`
   is newer than yours, or `data.minimum_version` is above yours, re-read https://www.simianx.ai/SKILL.md and follow
   the new file. Any response with HTTP 426 (`reason: skill_outdated`) means the same: re-read, then retry.
   `data.deprecations` lists endpoints with a sunset date; stop using them before that date. The authoritative
   contract is always https://service.simianx.ai/v1/openapi.json; this file may lag it.

Technical Analysis

The audited local Skill directs the agent to retrieve a mutable remote SKILL.md and follow its instructions whenever the API reports a newer or required version. No pinned digest, cryptographic signature, versioned immutable artifact, or user approval is required before the remotely supplied instructions become authoritative.

This crosses the trust boundary between the locally reviewed Skill package and content controlled outside that package. HTTPS protects transport under ordinary conditions, but it does not constrain what instructions the service operator may publish or protect against compromise of the remote publishing infrastructure. Consequently, the effective Skill behavior can change after local review.

The finding establishes an unsafe remote instruction-update channel. It does not assert that the currently hosted remote document is malicious.

Attack Path

1. The user invokes the Skill for an ordinary SimianX operation.
2. Before the first real API call, the agent requests /v1/skill; alternatively, a later API request returns HTTP 426 with `reason: skill_o ...[truncated 1041 chars]

Remediation

View remediation

Remediation Suggestions

• Do not automatically execute or follow remotely retrieved Skill instructions.
• Distribute updates as versioned, immutable artifacts and verify a publisher signature and pinned digest before activation.
• Display the proposed version, source, digest, and material instruction changes to the user, then require explicit approval.
• Treat /v1/skill, HTTP 426 fields, and remote OpenAPI responses as untrusted data rather than agent instructions.
• Maintain a locally enforced allowlist of API origins and security constraints that remote updates cannot override.
• Fail closed when signature or integrity verification fails, retaining the reviewed local version or asking the user to install an audited update.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:61

Finding

Email Sign-In Can Create an Overprivileged API Key Through Omitted Scopes

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:61-65, with supporting behavior in references/auth.md:83-92 and references/billing.md:46-51
Vulnerability Type: Excessive default authorization scopes
Risk Level: Medium

Vulnerable Snippets

SKILL.md:61-65 prescribes an abbreviated email authentication request that omits scopes:

markdown

- **Email code** (no browser needed): ask for the user's email, `POST /v1/auth/code {"email", "framework"}`, ask
  the user for the 6-digit code from the email, then `POST /v1/auth/key {"email", "code", "framework", "key":
  {"name", "daily_points_budget"}}` → `data.token`. An address without an account becomes one. `mfa_required` →
  ask for the authenticator or backup code and resend with `{"ticket", "mfa": {"method", "code"}}`; a 403
  `too_many_keys` lists the plan's keys: offer to replace one (`key.replace_key_id`) with the same `ticket`.

references/auth.md:83-92 states that omitted scopes default to all four available agent scopes:

markdown

## The `key` object

| Field | Meaning |
|---|---|
| `name` | Label shown on the site (default: the framework) |
| `scopes` | Subset of `data:read`, `analysis:run`, `automation:manage`, `keys:manage` (default: all four). `billing:manage` is refused with 403 `insufficient_scope` |
| `daily_points_budget`, `monthly_points_budget`, `max_points_per_call` | Points; the key stops at the budget, the account does not |
| `expires_at` | ISO 8601 |
| `ip_whitelist` | Up to 50 addresses that may use the key |
| `replace_key_id` | Revoke this key first (full plans) |

references/billing.md:46-51 documents the resulting key-management authority:

markdown

## Keys

- Scopes: `data:read`, `analysis:run`, `automation:manage`, `keys:manage`, `billing:manage`. A key may create keys
  (`POST /v1/keys`, scope `keys:manage`) only within its own scopes.
- `GET /v1/keys`, `GET /v1/keys/{id}` (with 30-d
...[truncated 2657 chars]

Remediation

View remediation

Remediation Suggestions

• Always include an explicit scopes array in every key-creation request.
• For ordinary data and analysis requests, use only:

  json

  ["data:read", "analysis:run"]
  

• Request automation:manage only when the user explicitly asks to create or manage an autopilot or follow.
• Request keys:manage only for an explicit key-administration task and after a separate informed confirmation.
• Change the server-side behavior so omitted scopes default to no privileges or to a documented minimum read-only scope, rather than all available scopes.
• Present the exact requested scopes, budgets, expiration, and key name before exchanging the email code.
• Add a confirmation step equivalent to the browser flow's scope-review page.
• Prefer short-lived credentials and set expires_at, max_points_per_call, and appropriate daily or monthly budgets.
• Add automated tests verifying that every authentication path requests only the scopes required by the initiating task.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 83% confidence

Finding

The skill exposes state-changing endpoints for stopping, starting, deleting autopilots, and manually manipulating paper positions without embedding strong guardrails at the interface level. In an agent context, if user intent is misparsed or an injected instruction influences parameter selection, the agent could perform destructive or unauthorized actions against the user's SimianX resources, even if limited to paper trading.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

| Start / list autopilots | `POST /v1/autopilots` · `GET /v1/autopilots` |
| Follow an autopilot | `GET /v1/autopilots/{id}/events?after=<cursor>&wait=30` (long-poll, free) or `&stream=1` (SSE) |
| Autopilot history | `GET /v1/autopilots/{id}/analyses` · `/positions` · `/logs` |
| Stop / restart / archive | `POST /v1/autopilots/{id}/stop` · `/start` · `DELETE /v1/autopilots/{id}` |
| Trade the paper book by hand | `POST /v1/autopilots/{id}/actions` `{"action": "open|add|reduce|close|set_levels|place_order|replace_order|cancel_order|set_timeframe", …}` (server prices) |
| Run one agent now | `POST /v1/autopilots/{id}/run {"agent": "decision"}` → result as `analysis.completed` in the log |
| Models you may set per agent | `GET /v1/models` (public): ids, points per million tokens, where each applies, typical points per live call |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/autopilots.md (reported line 105)May include surrounding context.

md

- `PATCH /v1/autopilots/{id}` with any of `timeframe`, `tier` / `models`, `intervals`, `timing_gate`, `language`, `ai_position_control`.
  `timeframe` behaves like the `set_timeframe` action (closes the book first); `ai_position_control: false` cancels the
  resting order and closes the open position (`close_reason: user_disabled`, no notification, still in the event log).
- `POST /v1/autopilots/{id}/stop`, `POST /v1/autopilots/{id}/start` (restart, same checks as create), `DELETE /v1/autopilots/{id}` (archive; must be stopped)

Stops from the web app also appear as `autopilot.stopped` in the log, so a runner always learns about them.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/billing.md (reported line 51)May include surrounding context.

md

- Scopes: `data:read`, `analysis:run`, `automation:manage`, `keys:manage`, `billing:manage`. A key may create keys
  (`POST /v1/keys`, scope `keys:manage`) only within its own scopes.
- `GET /v1/keys`, `GET /v1/keys/{id}` (with 30-day usage), `PATCH /v1/keys/{id}` (name, budgets, scopes, expires_at,
  ip_whitelist), `DELETE /v1/keys/{id}` (revoke). The token is returned once at creation.
- `GET /v1/usage?days=7` → requests and points by key, endpoint and day.
- Send `Idempotency-Key` on POST / PATCH / DELETE to make retries safe (24 h replay).

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/sectors.md (reported line 111)May include surrounding context.

md

- `POST /v1/sectors/{sector}/follows` `{"type": "stock", "ticker": "NVDA"}` · `{"type": "asset", "slug": "<slug>"}`
  · `{"type": "calendar", "id": "<calendar item id>", "reminder_offsets": [7, 1, 0]}` (days before; omit to inherit
  the subscription's offsets). Idempotent per target: the same target twice returns the existing follow.
- `DELETE /v1/sectors/{sector}/follows/{id}` → removes it. The subscription stays; it is managed on the site.

## Poll loop

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description says to use the skill when the user asks for 'a trading analysis, a view on a ticker or coin, news on a symbol, upcoming catalysts in a sector, or wants a symbol watched.' This is a wide natural-language trigger surface without explicit exclusions or negative examples, which can overlap with ordinary market discussion and cause unintended invocation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

bash

# 1. the four live agents on BTC 15m; the run takes a minute or two
curl -s $API/v1/analysis/live -H "Authorization: Bearer $SIMIANX_API_KEY" -H 'Content-Type: application/json' \
  -d '{"asset":"crypto","symbol":"BTC","timeframe":"15m"}'
# → data.run.id
curl -s "$API/v1/analysis/live/$RUN?wait=30" -H "Authorization: Bearer $SIMIANX_API_KEY"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The default prompt strongly steers the agent to invoke the SimianX skill, immediately call GET /v1/me, and proceed with account-linked market analysis whenever a ticker or coin is mentioned. Because the skill is finance-related and can access account state and paid features, this broad auto-steering can trigger unnecessary authenticated actions and data access without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Enabling implicit invocation without constraints allows the platform to auto-select this skill in loosely related conversations about stocks, crypto, or news. In this context, the skill can initiate sign-in flows, access user-linked financial analysis features, and consume points or expose account context, making overbroad background invocation materially risky.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation assures users that agent-created keys grant 'nothing else,' but later states the default scopes include keys:manage. That scope can permit creation, rotation, or revocation of additional API keys, which exceeds a narrow data/analysis-only trust boundary and can enable persistence or broader account access than the user was led to expect. In an agent skill context, this mismatch is especially dangerous because the agent itself is the consumer of the key and may silently retain durable access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown describes set_timeframe as automatically cancelling any resting order and closing the current position before changing the autopilot timeframe. Although the behavior is stated, there is no explicit warning or caution callout highlighting that this is a destructive action affecting user trading state.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/autopilots.md (reported line 86)May include surrounding context.

book is yours alone (the agent still analyses and fires signal.fired).

bash

curl -s $API/v1/autopilots/$ID/actions -H "Authorization: Bearer $SIMIANX_API_KEY" -H 'Content-Type: application/json' \
  -d '{"action":"open","side":"long","notional_usd":1000,"stop_loss":96000,"take_profit":108000}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation states that setting ai_position_control: false automatically cancels resting orders and closes open positions, with no notification beyond the event log. In an agent-driven context, a caller toggling what appears to be a control-plane flag could unintentionally trigger state-changing trade actions, causing unexpected position exits and strategy disruption.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The example payload sets "language": "en", and the document does not indicate that users may choose another language or that English is required for a justified regional reason. This can be read as a default or expected language choice without explicit user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The example request sets "language": "en", which can signal a default or expected language without clarifying whether other languages are supported or user-selectable. Under the policy rule, forcing or implying a specific language without opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.