Security audit

Trading Signals Ws

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its trading-alert purpose, but its docs encourage root-level auto-start deployment and include an under-explained external subscription API.

Review before installing. Prefer a virtual environment with pinned dependencies, run the bot as an unprivileged user or user-level service, avoid storing Telegram tokens in plaintext files, protect logs, and do not use the hosted Tinyore subscription/API examples unless you intentionally want to share the shown data with that service.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

Location: SKILL.md:56
Finding: Persistent systemd service runs the bot with unnecessary root privileges
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:12
Finding: Unpinned third-party dependencies create a supply-chain execution risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/signal_bot.py:33
Finding: Telegram bot token may be exposed through exception logging
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill documents capabilities that involve environment secrets, local file access, persistence, and network communication, but it does not declare any tool scope or permissions boundaries in the manifest. This increases the chance that an agent invokes the skill with broader-than-necessary access, making unintended credential use, file modification, or outbound transmission harder to review and constrain.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest description lists several broad activation contexts such as 'price alert system' and 'market monitor' without defining clear trigger boundaries or exclusions. In a manifest file, this can make invocation conditions ambiguous and overlap with common crypto-monitoring requests that may not specifically require this WebSocket Telegram bot skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The configuration example instructs users to place Telegram credentials into a local config and describes sending alerts to Telegram without an explicit warning that messages and identifiers are transmitted to a third party. This can lead users or agents to handle secrets and market activity data without informed consent or proper secret-management practices.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The deployment instructions tell the user to use sudo to write a systemd unit under /etc/systemd/system, which requires elevated privileges and creates a persistent service. If the referenced bot script or working directory is tampered with, this setup can run attacker-controlled code automatically with elevated operational trust on boot.
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
bash
# systemd service sudo tee /etc/systemd/system/signal-bot.service << 'EOF' [Unit] Description=Trading Signal Bot After=network.target

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 86% confidence
Finding: Enabling the service with sudo creates persistence and causes the bot to start automatically, which amplifies the impact of any malicious or compromised script in the deployment directory. In a skill context, persistent autorun instructions are more dangerous because users may follow them directly from documentation without reviewing the full trust chain.
Content: Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.
[Install] WantedBy=multi-user.target EOF sudo systemctl enable --now signal-bot

text
## Live Signal API (Optional)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The systemctl enable instruction establishes session persistence by configuring the bot to start automatically after reboot. Persistence is not inherently malicious, but in documentation for a networked bot with file/network access, providing autorun steps without stronger safety guidance increases the risk of long-lived unintended execution and harder-to-notice compromise.
Content: Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.
[Install] WantedBy=multi-user.target EOF sudo systemctl enable --now signal-bot

text
## Live Signal API (Optional)

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation introduces a hosted subscription/API service that is outside the core local WebSocket-to-Telegram bot purpose described in the manifest. Mixing an unrelated monetized external service into operational instructions can steer users or agents toward third-party data sharing and network calls they did not intend, increasing supply-chain and privacy risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The hosted API example requests the user's email and transmits it to a third-party subscription endpoint without an explicit privacy notice, retention statement, or consent language. This creates a clear privacy and data-sharing risk, especially because the section is embedded in what otherwise appears to be local bot setup documentation.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: This section instructs outbound requests to a third-party hosted service, including a POST that transmits an email address. External transmission is expected for some integrations, but here it is not clearly scoped in the manifest and is presented without trust, privacy, or validation guidance, increasing the risk of unintended data disclosure.
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
text
# Free tier (15-min delayed) curl https://api.tinyore.com/signals/free # Get API key (7-day free trial) curl -X POST https://api.tinyore.com/subscribe -H "Content-Type: application/json" -d '{"email":"you@example.com"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: This section instructs outbound requests to a third-party hosted service, including a POST that transmits an email address. External transmission is expected for some integrations, but here it is not clearly scoped in the manifest and is presented without trust, privacy, or validation guidance, increasing the risk of unintended data disclosure.
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
text
# Free tier (15-min delayed) curl https://api.tinyore.com/signals/free # Get API key (7-day free trial) curl -X POST https://api.tinyore.com/subscribe -H "Content-Type: application/json" -d '{"email":"you@example.com"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
curl https://api.tinyore.com/signals/free # Get API key (7-day free trial) curl -X POST https://api.tinyore.com/subscribe -H "Content-Type: application/json" -d '{"email":"you@example.com"}' # Pro tier (real-time, $5/mo) curl https://api.tinyore.com/signals/live -H "X-API-Key: YOUR_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.
md
curl https://api.tinyore.com/signals/free # Get API key (7-day free trial) curl -X POST https://api.tinyore.com/subscribe -H "Content-Type: application/json" -d '{"email":"you@example.com"}' # Pro tier (real-time, $5/mo) curl https://api.tinyore.com/signals/live -H "X-API-Key: YOUR_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
md
curl https://api.tinyore.com/signals/free # Get API key (7-day free trial) curl -X POST https://api.tinyore.com/subscribe -H "Content-Type: application/json" -d '{"email":"you@example.com"}' # Pro tier (real-time, $5/mo) curl https://api.tinyore.com/signals/live -H "X-API-Key: YOUR_KEY"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation repeatedly shows a Telegram bot token embedded directly in URLs, shell commands, Python config, and environment-variable examples without any warning that the token is a secret credential. In this context, users commonly copy-paste examples into shell history, shared docs, screenshots, or source files, which can expose the bot token and allow unauthorized parties to control the bot and read or send messages via the Telegram API.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/telegram_setup.md (reported line 27)May include surrounding context.
Test It

bash
curl -s "https://api.telegram.org/bot<TOKEN>/sendMessage" \ -d "chat_id=<CHAT_ID>" \ -d "text=Test signal 🚀" \ -d "parse_mode=HTML"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The function sends message content to the Telegram Bot API, which is a network operation transmitting potentially sensitive operational data off-system. Although logging exists for failures and disabled mode, there is no confirmation prompt or explicit user-facing warning that signal/status content will be sent to a third-party service.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/signal_bot.py (reported line 41)May include surrounding context.
python
log.info(f"[TG disabled] {msg}") return try: requests.post( f"https://api.telegram.org/bot{config.TG_BOT_TOKEN}/sendMessage", json={"chat_id": config.TG_CHAT_ID, "text": msg, "parse_mode": "HTML"}, timeout=10,

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/telegram_setup.md (reported line 21)May include surrounding context.
md
return try: requests.post( f"https://api.telegram.org/bot{config.TG_BOT_TOKEN}/sendMessage", json={"chat_id": config.TG_CHAT_ID, "text": msg, "parse_mode": "HTML"}, timeout=10, )

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/telegram_setup.md (reported line 27)May include surrounding context.
md
return try: requests.post( f"https://api.telegram.org/bot{config.TG_BOT_TOKEN}/sendMessage", json={"chat_id": config.TG_CHAT_ID, "text": msg, "parse_mode": "HTML"}, timeout=10, )

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/signal_bot.py (reported line 42)May include surrounding context.
python
return try: requests.post( f"https://api.telegram.org/bot{config.TG_BOT_TOKEN}/sendMessage", json={"chat_id": config.TG_CHAT_ID, "text": msg, "parse_mode": "HTML"}, timeout=10, )

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The bot stores signal history, last-signal timestamps, prices, and update metadata in signal_state.json, which affects local user/system data. The write is not accompanied by any confirmation, warning comment, or explicit disclosure that runtime data will be persisted.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T06 · System Persistence

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

Undeclared Tool Scope

Vague Triggers

Missing User Warnings

Sudo/Root Execution

Sudo/Root Execution

Session Persistence

Context-Inappropriate Capability

Missing User Warnings

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Missing User Warnings

External Transmission

Test It

Missing User Warnings

External Transmission

External Transmission

External Transmission

External Transmission

Missing User Warnings

Static analysis