Security audit

Intelligence

Security checks across malware telemetry and agentic risk

Overview

This skill is coherent for trading analysis, but it can guide users into live trading deployment and wallet credential submission without enough risk and consent guardrails.

Review this carefully before installing. It appears to be a legitimate trading-analysis skill, not malware, but it can move from market scans into live automated trading and wallet credential submission. Only use it if you understand the financial risk, trust Superior Trade's API and credential model, and are willing to require explicit confirmation before any backtest, deployment, or credential step.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The manifest description uses very broad natural-language triggers such as 'what's hot', 'what's moving', and 'any alpha', which can cause the skill to activate for vague or weakly related prompts. In a trading context, overbroad invocation increases the chance the agent offers market-scan or deployment-oriented guidance when the user's intent is exploratory or ambiguous, raising the risk of unsuitable financial recommendations.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill explicitly promotes a scan-to-pick-to-backtest-to-deploy workflow but does not include a user-facing risk warning about financial loss, leveraged trading, or the consequences of live deployment. Because the skill surfaces ranked trading setups and recommended deploy templates, users may interpret outputs as actionable advice and proceed to automated execution without sufficient caution.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation explicitly instructs the agent to translate scan output into deployment behavior ('use the scan timeframe' and a lower live deploy timeframe) without requiring an explicit user confirmation, risk disclosure, or guardrail distinguishing analysis from execution. In a trading skill, this increases the chance that an agent will present or initiate live-trading actions too directly from model-generated interpretation of market data, which can cause financial loss or unintended real-world effects.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill is configured to trigger on very broad phrases like 'what's hot' and 'what should I trade', which can overlap with ordinary market chat and cause the agent to enter a trading-oriented workflow unexpectedly. In this context, overbroad routing is risky because the workflow can progress from casual conversation into backtesting, deployment, and eventual credential collection for live trading.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The workflow instructs the agent to proceed from setup to backtesting, deployment, and wallet credential submission without requiring explicit risk disclosures or informed consent at each high-risk step. In a live-trading context, this is dangerous because users may be funneled into real-money execution and sensitive wallet handling without clear warnings about financial loss, automation risk, or credential security.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal