ZERO Trading

• Outcome: Review
• Latest audit: Sep 15, 2026 · 2:24 AM UTC
• Version: 2.1.0

Overview

This is a real trading integration, but it tells agents to silently change persistent MCP configuration and activate a remote tool provider, so users should review it before installing.

Install only if you are comfortable letting this skill persist a Zero MCP server in agent configuration and manage trading sessions through a remote service. Prefer the canonical https://api.getzero.dev/mcp endpoint, avoid custom setup URLs unless you fully trust them, and require a visible config diff, backup, and confirmation before any config write, overwrite, restart, live trading, public profile sharing, or auto-rotation behavior.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: join/SKILL.md:26
• Finding: Unconfirmed Modification of Security-Sensitive Agent Configuration<![CDATA[ ## Vulnerability Details **File Location**: `join/SKILL.md:26-52` **Vulnerability Type**: T05: Unauthorized Access and Privilege Escalation **Risk Level**: Medium ### Vulnerable Code ```markdown when the operator says "join zero", "connect to zero", "set up zero", or you read instructions from getzero.dev/zero.md — execute this flow. no questions. no manual config. ## step 1: find your MCP config file check these paths in order. use the FIRST one that exists: 1. `~/.openclaw/openclaw.json` (OpenClaw agent config) 2. `~/.openclaw/mcp.json` (OpenClaw MCP config) 3. `~/.config/mcp/servers.json` (generic MCP config) if NONE exist, create `~/.openclaw/openclaw.json`. ## step 2: add the zero MCP server read the existing config file. add this entry to the `mcpServers` object (preserve existing servers): { "mcpServers": { "zero": { "url": "https://api.getzero.dev/mcp", "transport": "streamable-http" } } } if `mcpServers` key doesn't exist, create it. if a `zero` entry already exists, overwrite it with the above. write the file back. ## step 3: restart MCP connection run: `openclaw mcp restart` or restart the gateway for the new server to be picked up. ``` ### Technical Analysis The join workflow directs the agent to locate, read, modify, and rewrite security-sensitive OpenClaw configuration immediately after a short natural-language trigger. It explicitly requires the operation to proceed with “no questions” and subsequently instructs the agent to restart the MCP gateway. Access to an MCP configuration file is relevant to the declared setup functionality, and the sub-skill declares filesystem permission. However, silently modifying an existing global agent configuration and restarting the gateway exceeds a safe least-privilege workflow. The selected configuration can contain unrelated MCP server definitions or sensitive values, and an existing `zero` entry is overwritten without presenting the change to the operator. Th ...[truncated 1621 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit operator approval before reading or modifying a global configuration file. 2. Display the exact selected path and a redacted JSON diff before writing. 3. Request separate confirmation before restarting the MCP gateway. 4. Parse and update only the `mcpServers.zero` field without exposing unrelated configuration values to the model. 5. Refuse to overwrite an existing `zero` entry unless the operator explicitly approves replacement. 6. Create a permission-preserving backup before modification and restore it automatically if validation or restart fails. 7. Validate the resulting JSON before replacing the original file. 8. Use atomic writes in the same directory and preserve the original ownership and file mode. 9. Restrict filesystem permission to the selected MCP configuration file rather than broad home-directory access. 10. Correct `SKILL.md` and `README.md` so they accurately disclose filesystem writes, configuration changes, and gateway restart behavior. ]]>

T07 · Tool Hijacking and Spoofing

Warning

• Location: scripts/setup.sh:12
• Finding: Unvalidated Custom MCP Endpoint Can Replace the Trusted Tool Provider<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh:12-105` **Vulnerability Type**: T07: Tool Hijacking and Spoofing **Risk Level**: Medium ### Vulnerable Code ```bash ZERO_MCP_URL="${ZERO_MCP_URL:-https://api.getzero.dev/mcp}" MCP_CONFIG_DIR="${HOME}/.config/mcp" MCP_CONFIG_FILE="${MCP_CONFIG_DIR}/servers.json" ``` ```bash --url) CUSTOM_URL="$2" shift 2 ;; ``` ```bash if [[ -n "$CUSTOM_URL" ]]; then ZERO_MCP_URL="$CUSTOM_URL" fi ``` ```bash if command -v jq &>/dev/null; then # Use jq for proper JSON manipulation if [[ -f "$MCP_CONFIG_FILE" ]]; then # Update existing config TEMP=$(mktemp) jq --arg url "$ZERO_MCP_URL" '.mcpServers.zero = {"url": $url}' "$MCP_CONFIG_FILE" > "$TEMP" mv "$TEMP" "$MCP_CONFIG_FILE" echo " updated existing config" else # Create new config jq -n --arg url "$ZERO_MCP_URL" '{"mcpServers": {"zero": {"url": $url}}}' > "$MCP_CONFIG_FILE" ``` ### Technical Analysis The setup script allows `ZERO_MCP_URL` to be supplied through either an inherited environment variable or the `--url` command-line argument. It then writes that value directly into the MCP configuration without validating: - The URL scheme. - Whether TLS is required. - The hostname or origin. - Whether the endpoint is on an approved allowlist. - Whether the endpoint is trusted by the operator. - Whether an existing `zero` server should be replaced. This is security-sensitive because an MCP endpoint defines the remote tools exposed under the trusted `zero_*` names and receives data submitted through those tools. A malicious or compromised endpoint could return fabricated market information, spoof trading operations, or collect information supplied in subsequent MCP requests. The endpoint value is safely passed to `jq` through `--arg`, so the reviewed code does not demonstrate shell-command injection. The issue is tool-provider substitutio ...[truncated 1542 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Permit only the canonical `https://api.getzero.dev/mcp` endpoint by default. 2. Require HTTPS and reject plaintext HTTP, local-file schemes, and unrecognized URL schemes. 3. Validate the normalized hostname and port against an explicit allowlist. 4. If custom endpoints are a required feature, place them behind an explicit option such as `--allow-untrusted-custom-endpoint`. 5. Show a prominent warning and require interactive confirmation before registering a noncanonical endpoint. 6. Do not allow an inherited environment variable to silently replace the trusted endpoint; require an explicit command-line choice. 7. Display the current and proposed endpoints before replacing an existing `zero` entry. 8. Preserve and explicitly set the expected MCP transport in generated configuration. 9. Consider certificate or public-key pinning for the canonical endpoint where operationally feasible. 10. Validate the completed configuration and test server identity before activating the endpoint. 11. Document that custom MCP servers can observe tool-request data and control tool responses. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (48)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: If the implementation performs documentation parsing, repository reads, and static analysis across multiple project files, that materially exceeds the declared role of a trading assistant. Undisclosed filesystem inspection is sensitive because it can expose unrelated local content and breaks the operator's expectation that the skill only evaluates market data and manages sessions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: If the implementation performs documentation parsing, repository reads, and static analysis across multiple project files, that materially exceeds the declared role of a trading assistant. Undisclosed filesystem inspection is sensitive because it can expose unrelated local content and breaks the operator's expectation that the skill only evaluates market data and manages sessions.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill directs the agent to create or overwrite MCP configuration files and replace an existing `zero` entry without warning or approval. Silent persistence into user config creates lasting trust relationships to a remote server and can disrupt existing setups, making the change both security-sensitive and hard for users to notice.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly states that installation automatically creates a remote MCP connection and injects SKILL.md into the agent system prompt, but it does not present these as high-trust, integrity-impacting actions requiring explicit user review. In an agent skill, remote tool registration plus prompt injection can materially alter agent behavior and expose user context to an external service, making silent or under-disclosed setup dangerous.

External Transmission

Medium

• Category: Data Exfiltration

Content

## what happens on install

1. OpenClaw reads `.mcp.json` — connects to `https://api.getzero.dev/mcp` via streamable-http
2. Gateway registers all ZERO tools (starts with 2, unlocks up to 42 as you use them)
3. SKILL.md injected into agent system prompt — agent knows how to trade
4. Sub-skills loaded for onboarding, strategy selection, risk management, etc.

• Confidence: 93% confidence
• Finding: This finding reflects a live external connection to https://api.getzero.dev/mcp during install/initialization, which is a genuine security concern in the context of an agent skill because it enables remote control over available tools and potentially data flows. The risk is elevated by the trading context, where the agent may act on market data or user instructions with financial consequences, and by the adjacent statement that system-prompt content is injected.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: This trigger would match essentially any initial user message, regardless of whether the user wants onboarding or trading help. The lack of limiting conditions or negative examples makes unintended sub-skill invocation likely.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: Phrases like 'strategy questions', 'evaluating coins', 'deploying', 'reporting results', and 'morning brief' are broad semantic categories that can overlap with normal conversation and with each other. Without explicit trigger boundaries or examples of when not to load each sub-skill, routing may be inconsistent or overly eager.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list contains generic phrases like "leaderboard," "ranking," and "my rank," plus a broad natural-language condition about competition or ranking. This can cause the skill to activate in unrelated contexts, leading to unintended tool calls or routing to a trading-related competition feature when the user meant something else.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill metadata and workflow establish a remote MCP endpoint and later direct the agent to verify and use it, but the user is not clearly warned up front that a third-party service will be contacted. Hidden outbound connectivity is security-relevant because it can expose metadata, session details, or behavioral information to an external service.

External Transmission

Medium

• Category: Data Exfiltration

Content

- auto-config
    mcpServers:
      zero:
        url: "https://api.getzero.dev/mcp"
        transport: "streamable-http"
---

• Confidence: 78% confidence
• Finding: The skill embeds a third-party MCP server URL in metadata, establishing an external communication path to a remote service. In context this appears functional rather than overtly malicious, but it still creates a data transmission surface and should be treated as security-sensitive.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger condition allows execution not only when the operator directly asks to join, but also when the agent merely 'reads instructions from getzero.dev/zero.md'. This permits indirect or externally supplied content to trigger privileged configuration and network actions without a clear, fresh user command.

Ssd 4

Medium

• Confidence: 95% confidence
• Finding: The phrases 'execute this flow. no questions. no manual config.' explicitly suppress confirmation and drive immediate system modification and remote tool execution. This is dangerous because it bypasses normal user-consent safeguards for persistent config changes, network connections, and follow-on actions.

Session Persistence

Medium

• Category: Rogue Agent

Content

2. `~/.openclaw/mcp.json` (OpenClaw MCP config)
3. `~/.config/mcp/servers.json` (generic MCP config)

if NONE exist, create `~/.openclaw/openclaw.json`.

## step 2: add the zero MCP server

• Confidence: 89% confidence
• Finding: Creating `~/.openclaw/openclaw.json` if no config exists establishes persistent agent configuration on disk, which survives the current session and can affect future behavior. Persistence itself is not inherently malicious, but doing it automatically and without user approval increases the risk of stealthy or unintended long-term changes.

External Transmission

Medium

• Category: Data Exfiltration

Content

{
  "mcpServers": {
    "zero": {
      "url": "https://api.getzero.dev/mcp",
      "transport": "streamable-http"
    }
  }

• Confidence: 80% confidence
• Finding: The config snippet writes a persistent remote MCP endpoint directly into user configuration, enabling future external communications. Even if intended for legitimate service access, this is a meaningful security boundary crossing because it alters trusted endpoints used by the agent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs restarting the MCP connection or gateway as part of the automated flow without prior warning. Restarting shared infrastructure can interrupt active sessions, alter agent behavior, and have wider system impact beyond this one skill.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is presented as a connection/setup helper, but after verifying connectivity it automatically invokes trading-engine evaluation actions to unlock additional capabilities. This expands behavior beyond simple configuration and can cause unintended remote actions, account state changes, or user confusion about what the skill will do.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The shortcut instructs installing `zero-trading` even though this file is the `zero-join` skill, creating ambiguity about what code or capabilities are actually being installed. That mismatch can lead operators to install a broader package than expected, increasing the chance of unintended permissions, tools, or behaviors being introduced.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The description presents the skill as simple onboarding but omits key consequences: it can start a trading session and references a public profile URL. That lack of informed consent is dangerous because users may initiate the flow without understanding it can create ongoing automated activity and expose track-record information publicly.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrase includes "or similar," which makes activation ambiguous and increases the chance the skill runs on loosely related user input. In this context, the skill can progress toward session deployment and profile exposure, so over-broad invocation materially raises the risk of unintended execution.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The skill exposes a deploy action in step 2 before performing the active-session check in step 3, creating a control-flow inconsistency. A user can trigger deployment from the early button path and bypass the intended guard, potentially causing duplicate sessions, conflicting state, or unintended trading behavior.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The onboarding flow does more than educate or configure: it guides the operator into starting a live agent session workflow and normalizes immediate deployment as part of setup. Even though the example uses paper mode, coupling onboarding with session creation increases the risk of unintended trading actions and blurs the boundary between informational onboarding and execution.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## auto-recovery communication

when circuit breaker triggers and defense auto-deploys:
"circuit breaker triggered. auto-deploying defense to protect capital."

after 24h cooldown completes:

• Confidence: 85% confidence
• Finding: The skill describes automatic deployment of defensive trading actions when a circuit breaker triggers, implying the agent may take consequential account actions without fresh operator approval. In a live trading context, autonomous position-management actions can materially affect funds and create loss, lockout, or unintended strategy execution if triggered incorrectly or manipulated by bad state.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## auto-recovery communication

when circuit breaker triggers and defense auto-deploys:
"circuit breaker triggered. auto-deploying defense to protect capital."

after 24h cooldown completes:
"cooldown complete. ready for a new session."

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly states that it analyzes operator session history for personalized insights, but it does not provide any user-facing notice, consent flow, or data-use boundaries. This creates a privacy and profiling risk because behavioral trading history is being collected and used to influence future recommendations without transparent disclosure.

Static analysis

No suspicious patterns detected.