Crypto Backtest

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:33 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward crypto backtesting tool, with ordinary network data fetching and local JSON export that fit its stated purpose.

Install dependencies in a virtual environment, consider pinning reviewed versions of ccxt and removing numpy unless needed, and choose JSON output paths carefully because existing files may be overwritten.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned and Unnecessary Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 13
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash

pip install ccxt numpy

Technical Analysis

The installation command retrieves ccxt, numpy, and their transitive dependencies without version constraints, a dependency lockfile, or cryptographic integrity hashes. Consequently, installation resolves mutable package releases at execution time rather than a set of reviewed and reproducible artifacts.

The included Python scripts use ccxt, but no audited project file imports or otherwise requires numpy. Installing this unnecessary package expands the dependency graph and supply-chain attack surface without supporting the documented implementation.

Exploitation depends on compromise of a named package, one of its transitive dependencies, or its distribution channel. No evidence indicates that the currently published packages are malicious; the vulnerability is the project's failure to constrain and verify the software installed with the user's privileges.

Attack Path

1. An attacker compromises a future release of ccxt, numpy, or a transitive dependency, or compromises the relevant package-distribution channel.
2. A user follows the Quick Start instructions in SKILL.md.
3. pip resolves the unconstrained dependency names to the affected mutable release.
4. Package installation or later import executes attacker-controlled code with the permissions of the user running the command.
5. The code can access resources available to that user and may affect subsequent backtesting operations.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user performing the installation or running the scripts. The accessible scope may include that user's files, environment variables, network access, and writable application resources. If ...[truncated 433 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove numpy from the installation instructions unless the implementation begins to require it.
2. Pin ccxt and every required transitive dependency to reviewed versions in a requirements or lock file.
3. Record cryptographic hashes and enforce them during installation, for example:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Generate the lock file through a controlled dependency-review process and regenerate it only after reviewing release notes and security advisories.
5. Install dependencies inside a dedicated virtual environment under a non-privileged user:

   bash

   python -m venv .venv
   . .venv/bin/activate
   python -m pip install --require-hashes -r requirements.txt
   

6. Add automated dependency and vulnerability scanning to the maintenance workflow.
7. Avoid invoking pip with administrator or root privileges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code substantially matches the core declared purpose: it fetches OHLCV via ccxt, supports EMA/RSI/MACD/Bollinger strategies, performs backtesting with leverage/SL/TP/fees, computes win rate, PnL, drawdown, and exports JSON. However, the description materially overstates one capability: 'runs multi-strategy sweeps' is not present. The CLI accepts only a single --strategy and a single parameter set at a time; there is no looping over parameter combinations or simultaneous comparison across multiple strategies. Additionally, while the description says 'any ccxt-supported exchange,' the code forces options.defaultType='swap', so behavior is specifically aimed at futures/swap markets rather than a generic exchange/data fetcher. Because the primary purpose is still aligned but an advertised analysis capability is missing, this is a moderate description-behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill advertises behavior that writes output files (for example, JSON export) but does not declare any tool scope such as permissions or allowed-tools. That creates an authorization gap where an agent or user may not clearly understand that filesystem writes are part of the skill's behavior, increasing the risk of unintended file creation or overwrite in an automated environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file describes network-backed data fetching from ccxt-supported exchanges and result export to JSON, which can affect privacy and local data handling. The description and usage examples do not include any warning or disclosure about outbound network access or file creation.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/backtest_engine.py (reported line 81)May include surrounding context.

python

def fetch_candles(symbol: str, timeframe: str = "1h", limit: int = 1000,
                  exchange_id: str = "bybit") -> list:
    exchange_class = getattr(ccxt, exchange_id)
    exchange = exchange_class({"enableRateLimit": True, "options": {"defaultType": "swap"}})
    candles = exchange.fetch_ohlcv(symbol, timeframe, limit=limit)
    return [{"t": c[0], "o": c[1], "h": c[2], "l": c[3], "c": c[4], "v": c[5]} for c in candles]

Static analysis

No suspicious patterns detected.