Agent Trading Bot

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:14 AM UTC
• Version: 1.0.0

Overview

This trading skill does not appear to steal data, but it overstates live-trading safety features and a kill switch that the code does not actually provide.

Treat this as a paper-trading or educational helper only. Do not rely on it for live trading, stop-loss protection, drawdown protection, backtesting, multi-exchange automation, or emergency position closure, and avoid providing trading-capable API keys unless the live behavior is corrected and independently verified.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/agent-trading-bot.py:583

Finding

Live Trading Safety Controls and Kill Switch Are Nonfunctional but Report Success

Content

View full analysis

usdt_balance: print(f"\n❌ Insufficient balance: ${usdt_balance:.2f} USDT available, ${amount} requested") sys.exit(1) # Position size check if usdt_balance > 0 and (amount / usdt_balance * 100) > risk['max_p ...[truncated 5530 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This documentation materially overstates safety-critical trading functionality, including live execution, stop-loss enforcement, exchange integrations, and backtesting that apparently do not exist. In a trading context, false claims about protective controls can cause users or agents to rely on nonexistent safeguards, leading to financial loss, unmanaged positions, or accidental live-market actions under false assumptions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill advertises capabilities that involve environment variables, file access, and network connectivity but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent setting, missing least-privilege boundaries can let the runtime grant broader access than intended, increasing the blast radius if the skill is misused or later extended with unsafe logic.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The quick-start example shows a live-trading command without the documented --live safety flag, directly contradicting the stated double-confirmation model. In a high-risk financial skill, contradictory operator guidance can normalize unsafe invocation patterns and may cause users to attempt real trading without understanding required safety interlocks.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

See references/strategies.md for detailed strategy documentation.

Custom Strategies

Create a strategy file at strategies/<name>.json:

json

{
  "name": "my-strategy",

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The top-level documentation states the bot will never trade real money without explicit approval. Later, the kill-switch documentation and control flow present '--force' as sufficient to execute closing all positions, which is itself real-money trading activity; this contradicts the stronger approval claim in the docstring.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.