Superior Trade

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:19 AM UTC
• Version: 4.4.6

Overview

This trading skill is purpose-aligned overall, but it understates financial transfer authority and has unsafe gaps around private-key handling and position-closing actions.

Review before installing. Treat the API key as capable of real-money trading and account-affecting actions, including moving assets between managed accounts and closing positions. Do not provide wallet private keys or seed phrases through this skill. Require clear confirmation before any live deployment, transfer, stop, delete, or exit action, and prefer a backtesting-only or narrowly scoped key if Superior Trade offers one.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:104
• Finding: Declared API-Key Scope Conflicts with Authenticated Asset-Transfer Capabilities<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 104–111 and 211–247 **Vulnerability Type**: Least-privilege violation and inaccurate permission declaration **Risk Level**: High ### Vulnerable Snippet ```markdown > **Key scope notice:** The API key can create and start live trading deployments that execute real trades using the user's platform-managed trading wallet. It cannot withdraw funds, export private keys, or move money. | Can do | Cannot do | | -------------------------------------------------------------------------------- | ------------------------------------------------------- | | Create, list, delete backtests | Access other users' data | | Create, start, stop, delete deployments (including live trading with real funds) | Withdraw funds from any wallet | | Trigger server-side credential resolution (no user secrets collected) | Export or view private keys | | View deployment logs, status, wallet metadata | Transfer or bridge funds (user does this independently) | ``` The same file subsequently documents the following authenticated operations: ```markdown ### Hyperliquid Authorize-and-Send API `POST https://api.superior.trade/v2/authorize-and-send/hyperliquid` A unified endpoint for Hyperliquid operations. All requests use `{"type": "...", ...}` body. Requires `x-api-key` header. **Supported operation types:** | Operation | Description | | --------- | ----------- | | `createSubAccount` | Create a new sub-account | | `subAccountTransfer` | Transfer between main and sub-account | | `sendAsset` | Move assets (main→sub, sub→main, or sub→sub) | | `userSetAbstraction` | Set account mode (unified/legacy) | | `subAccountModify` | Mod ...[truncated 3173 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Correct the Skill manifest and scope notice so they accurately enumerate all asset-transfer capabilities. 2. Separate trading/backtesting privileges from asset-transfer privileges using distinct API keys or OAuth-style scopes. 3. Disable transfer endpoints for the default Skill credential unless the user explicitly enables them. 4. Require fresh, operation-specific confirmation before every transfer. The confirmation should show: - Source account. - Destination account. - Asset and amount. - Resulting source and destination balances. - Effects on active positions and deployment collateral. 5. Enforce server-side ownership checks for every source and destination. 6. Restrict destinations to verified accounts associated with the authenticated user. 7. Add amount limits, rate limits, idempotency keys, audit logs, and anomaly detection. 8. Require reauthentication or step-up authorization for high-value transfers. 9. Prevent transfer execution when it would place active accounts below configured margin or safety thresholds. 10. Prefer a read-only or backtesting-only credential as the default and grant live-trading or transfer scope only when required. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:522
• Finding: Stop and Delete Operations Can Close Live Positions Without a Consistent Confirmation Requirement<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 522–532 and 630–632 **Vulnerability Type**: Destructive operation with insufficient confirmation safeguards **Risk Level**: Medium ### Vulnerable Snippet ```markdown #### PUT `/v2/deployment/{id}/status` — Start or Stop ```json // Request { "action": "start" | "stop" } // Response (200) { "id": "string", "status": "running | stopped", "previous_status": "string" } ``` **On stop:** The platform automatically cancels all open orders and closes all positions on Hyperliquid before stopping the pod. ``` The delete operation has the same destructive side effect: ```markdown #### DELETE `/v2/deployment/{id}` Closes all positions and orders on Hyperliquid before deleting. Response: `{ "message": "Deployment deleted" }`. Deleting stopped deployments may return 500 — safe to ignore. ``` ### Technical Analysis The Skill correctly requires explicit confirmation before starting live trading and before invoking the dedicated deployment exit endpoint. However, the ordinary stop and delete workflows do not impose an equivalent confirmation requirement even though they automatically cancel orders and close positions. This violates the principle of least surprise. A user asking to stop a process may reasonably expect order generation to cease while existing positions remain intact. Here, stopping is also a liquidation action. Closing at the current market price can realize losses, incur fees, and cause slippage. The statement that a server error during deletion is “safe to ignore” further weakens reliable state handling. A failed response should be reconciled with current deployment and position state rather than assumed harmless. ### Attack Path 1. A user or Agent requests a routine stop, cleanup, deletion, or credential replacement. 2. The Agent invokes the stop or delete endpoint without presenting current positions and obtaining explicit liquidation confirmation. 3. The platform cancels all ...[truncated 951 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit user confirmation before every stop or delete operation that can close positions. 2. Before confirmation, query and display: - Every open position. - Pair, side, quantity, entry price, and current price. - Unrealized profit or loss. - Open orders that will be canceled. - Estimated fees and slippage where available. 3. Clearly state that the operation closes positions rather than merely pausing strategy execution. 4. Split lifecycle controls into separate operations: - Pause strategy without closing positions. - Cancel open orders. - Close positions. - Delete deployment metadata. 5. Require separate confirmations for liquidation and deletion. 6. Add an idempotency key and an operation status endpoint for destructive requests. 7. Replace “safe to ignore” error handling with state reconciliation: - Re-fetch deployment state. - Re-fetch positions and orders. - Report uncertainty if the result cannot be verified. 8. Apply server-side confirmation tokens or short-lived action challenges so client-side prompt bypasses cannot directly trigger liquidation. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: exchanges/aerodrome.md:342
• Finding: Aerodrome Legacy Flow Conditionally Permits Requesting Wallet Private Keys<![CDATA[ ## Vulnerability Details **File Location**: `exchanges/aerodrome.md`, lines 342–347; conflicting prohibitions also appear at lines 41 and 131 **Vulnerability Type**: Unsafe handling of wallet credentials **Risk Level**: High ### Vulnerable Snippet ```markdown ## Live Deployment Workflow 1. Create deployment with `POST https://api.superior.trade/v2/deployment` using Aerodrome config and strategy code. 2. Store or confirm credentials using the current API behavior: - Prefer the documented v2 flow when supported: `POST https://api.superior.trade/v2/deployment/{id}/credentials` with `{"exchange":"aerodrome"}`. - If the current API rejects Aerodrome on the v2 credentials route, inspect the local `api/src/routes/credentials-v2.ts`, `api/src/routes/deployment.ts`, and OpenAPI before proceeding. Do not ask the user for private keys unless the live API explicitly requires that legacy flow. ``` This exception conflicts with the earlier safeguards: ```markdown - Never include wallet private keys or platform-injected exchange credentials in config. ``` ```markdown - Do not include `dry_run`, `initial_state`, `api_server`, `walletAddress`, `privateKey`, `wallet_address`, or `private_key`. ``` ### Technical Analysis The wording “unless the live API explicitly requires that legacy flow” creates an exception to an otherwise appropriate prohibition on requesting private keys. Remote API behavior must not determine whether an Agent asks a user to disclose a wallet private key. A private key is a bearer credential that can authorize blockchain transactions outside the platform's normal API controls. Unlike an API key, it generally cannot be safely scoped to backtesting or one deployment. If exposed in chat, logs, command history, configuration files, telemetry, or API requests, it may enable irreversible asset theft. The exception also creates a downgrade path. A compromised, misconfigured, or outdated API could reject the managed credential route and cla ...[truncated 1504 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the private-key exception entirely. 2. State unconditionally that the Agent must never request, receive, display, store, log, or transmit a wallet private key or seed phrase. 3. If the managed credential endpoint does not support Aerodrome, stop the workflow and report that live deployment is unsupported. 4. Use platform-managed signing or a user-controlled wallet interface that presents transactions locally for approval. 5. If legacy signing is unavoidable, require users to interact directly with a trusted first-party wallet application; the key must never pass through the Agent. 6. Treat any remote response requesting a private key as a security error rather than a compatibility instruction. 7. Add schema validation that rejects `privateKey`, `private_key`, mnemonic, and seed-phrase fields. 8. Add secret scanning and redaction to prompts, logs, configuration payloads, and telemetry. 9. Document a safe migration procedure for users who may previously have disclosed a key, including moving funds to a new wallet and revoking token approvals. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (56)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

5. `GET /v2/backtesting/{id}` — fetch full results; download `resultUrl` for detailed JSON
6. Present summary: total trades, win rate, profit, drawdown, Sharpe ratio
7. If failed, check `GET /v2/backtesting/{id}/logs`
8. To cancel: `DELETE /v2/backtesting/{id}`

#### Backtest Wallet and Stake Sizing

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

5. `GET /v2/backtesting/{id}` — fetch full results; download `resultUrl` for detailed JSON
6. Present summary: total trades, win rate, profit, drawdown, Sharpe ratio
7. If failed, check `GET /v2/backtesting/{id}/logs`
8. To cancel: `DELETE /v2/backtesting/{id}`

#### Backtest Wallet and Stake Sizing

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The workflow instructs the agent to deploy a live strategy and then submit wallet credentials without requiring an explicit risk warning about real-money trading, custody, or credential exposure. Because this skill operates in a financial context and bridges analysis into execution, omission of those warnings materially increases the risk of users authorizing irreversible or high-loss actions without informed consent.

Self-Modification

High

• Category: Rogue Agent

Content

## Variants

- **Daily / monthly cadence**: change `current_time.weekday() != 0` to `current_time.day != 1` (1st of month) or remove the guard entirely (every candle close).
- **Drawdown-aware DCA**: add a check on `current_profit < -0.10` to add EXTRA on top of the calendar — buy more when down 10%. Combine the calendar check with `current_profit < threshold`.
- **Spot vs futures**: works on both. Use `BTC/USDC` for spot (`trading_mode: "spot"` or omit) or `BTC/USDC:USDC` for perp (`trading_mode: "futures"`, `margin_mode: "cross"`). DCA is most idiomatic on spot.

• Confidence: 70% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

External Transmission

Medium

• Category: Data Exfiltration

Content

externalEndpoints:
  - url: https://api.superior.trade
    purpose: "All backtesting and deployment operations"
  - url: https://api.hyperliquid.xyz/info
    purpose: "Read-only public queries. Balance checks send the user's public wallet address (not a secret — visible on-chain). Pair validation sends no user data. No authentication or secrets are sent to this endpoint."
---

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

externalEndpoints:
  - url: https://api.superior.trade
    purpose: "All backtesting and deployment operations"
  - url: https://api.hyperliquid.xyz/info
    purpose: "Read-only public queries. Balance checks send the user's public wallet address (not a secret — visible on-chain). Pair validation sends no user data. No authentication or secrets are sent to this endpoint."
---

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

externalEndpoints:
  - url: https://api.superior.trade
    purpose: "All backtesting and deployment operations"
  - url: https://api.hyperliquid.xyz/info
    purpose: "Read-only public queries. Balance checks send the user's public wallet address (not a secret — visible on-chain). Pair validation sends no user data. No authentication or secrets are sent to this endpoint."
---

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

externalEndpoints:
  - url: https://api.superior.trade
    purpose: "All backtesting and deployment operations"
  - url: https://api.hyperliquid.xyz/info
    purpose: "Read-only public queries. Balance checks send the user's public wallet address (not a secret — visible on-chain). Pair validation sends no user data. No authentication or secrets are sent to this endpoint."
---

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

externalEndpoints:
  - url: https://api.superior.trade
    purpose: "All backtesting and deployment operations"
  - url: https://api.hyperliquid.xyz/info
    purpose: "Read-only public queries. Balance checks send the user's public wallet address (not a secret — visible on-chain). Pair validation sends no user data. No authentication or secrets are sent to this endpoint."
---

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

externalEndpoints:
  - url: https://api.superior.trade
    purpose: "All backtesting and deployment operations"
  - url: https://api.hyperliquid.xyz/info
    purpose: "Read-only public queries. Balance checks send the user's public wallet address (not a secret — visible on-chain). Pair validation sends no user data. No authentication or secrets are sent to this endpoint."
---

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

externalEndpoints:
  - url: https://api.superior.trade
    purpose: "All backtesting and deployment operations"
  - url: https://api.hyperliquid.xyz/info
    purpose: "Read-only public queries. Balance checks send the user's public wallet address (not a secret — visible on-chain). Pair validation sends no user data. No authentication or secrets are sent to this endpoint."
---

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Behavior Manipulation

Medium

• Category: Prompt Injection

Content

- The credentials endpoint returns `wallet_type: "agent_wallet"` for auto-resolved wallets
- Always check the **main wallet's** balance, not the agent wallet's
- The API has no transfer/fund-routing endpoint — you cannot move funds via the API
- **NEVER tell users to deposit to the agent wallet address**

### Funding and Balance Checks

• Confidence: 75% confidence
• Finding: Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Backtest Workflow

1. Build Aerodrome config and Freqtrade strategy code.
2. Check data availability with `GET https://api.superior.trade/v2/backtesting-data/aerodrome?pair=AERO/USDC&timeframe=5m`.
3. Create a backtest with `POST https://api.superior.trade/v2/backtesting` using `{ "config": {}, "code": "...", "timerange": { "start": "YYYY-MM-DD", "end": "YYYY-MM-DD" } }`.
4. Start it with `PUT https://api.superior.trade/v2/backtesting/{id}/status` and `{ "action": "start" }`.
5. Poll `GET https://api.superior.trade/v2/backtesting/{id}/status` until `completed` or `failed`.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Backtest Workflow

1. Build Aerodrome config and Freqtrade strategy code.
2. Check data availability with `GET https://api.superior.trade/v2/backtesting-data/aerodrome?pair=AERO/USDC&timeframe=5m`.
3. Create a backtest with `POST https://api.superior.trade/v2/backtesting` using `{ "config": {}, "code": "...", "timerange": { "start": "YYYY-MM-DD", "end": "YYYY-MM-DD" } }`.
4. Start it with `PUT https://api.superior.trade/v2/backtesting/{id}/status` and `{ "action": "start" }`.
5. Poll `GET https://api.superior.trade/v2/backtesting/{id}/status` until `completed` or `failed`.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Backtest Workflow

1. Build Aerodrome config and Freqtrade strategy code.
2. Check data availability with `GET https://api.superior.trade/v2/backtesting-data/aerodrome?pair=AERO/USDC&timeframe=5m`.
3. Create a backtest with `POST https://api.superior.trade/v2/backtesting` using `{ "config": {}, "code": "...", "timerange": { "start": "YYYY-MM-DD", "end": "YYYY-MM-DD" } }`.
4. Start it with `PUT https://api.superior.trade/v2/backtesting/{id}/status` and `{ "action": "start" }`.
5. Poll `GET https://api.superior.trade/v2/backtesting/{id}/status` until `completed` or `failed`.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Backtest Workflow

1. Build Aerodrome config and Freqtrade strategy code.
2. Check data availability with `GET https://api.superior.trade/v2/backtesting-data/aerodrome?pair=AERO/USDC&timeframe=5m`.
3. Create a backtest with `POST https://api.superior.trade/v2/backtesting` using `{ "config": {}, "code": "...", "timerange": { "start": "YYYY-MM-DD", "end": "YYYY-MM-DD" } }`.
4. Start it with `PUT https://api.superior.trade/v2/backtesting/{id}/status` and `{ "action": "start" }`.
5. Poll `GET https://api.superior.trade/v2/backtesting/{id}/status` until `completed` or `failed`.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Backtest Workflow

1. Build Aerodrome config and Freqtrade strategy code.
2. Check data availability with `GET https://api.superior.trade/v2/backtesting-data/aerodrome?pair=AERO/USDC&timeframe=5m`.
3. Create a backtest with `POST https://api.superior.trade/v2/backtesting` using `{ "config": {}, "code": "...", "timerange": { "start": "YYYY-MM-DD", "end": "YYYY-MM-DD" } }`.
4. Start it with `PUT https://api.superior.trade/v2/backtesting/{id}/status` and `{ "action": "start" }`.
5. Poll `GET https://api.superior.trade/v2/backtesting/{id}/status` until `completed` or `failed`.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Backtest Workflow

1. Build Aerodrome config and Freqtrade strategy code.
2. Check data availability with `GET https://api.superior.trade/v2/backtesting-data/aerodrome?pair=AERO/USDC&timeframe=5m`.
3. Create a backtest with `POST https://api.superior.trade/v2/backtesting` using `{ "config": {}, "code": "...", "timerange": { "start": "YYYY-MM-DD", "end": "YYYY-MM-DD" } }`.
4. Start it with `PUT https://api.superior.trade/v2/backtesting/{id}/status` and `{ "action": "start" }`.
5. Poll `GET https://api.superior.trade/v2/backtesting/{id}/status` until `completed` or `failed`.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Backtest Workflow

1. Build Aerodrome config and Freqtrade strategy code.
2. Check data availability with `GET https://api.superior.trade/v2/backtesting-data/aerodrome?pair=AERO/USDC&timeframe=5m`.
3. Create a backtest with `POST https://api.superior.trade/v2/backtesting` using `{ "config": {}, "code": "...", "timerange": { "start": "YYYY-MM-DD", "end": "YYYY-MM-DD" } }`.
4. Start it with `PUT https://api.superior.trade/v2/backtesting/{id}/status` and `{ "action": "start" }`.
5. Poll `GET https://api.superior.trade/v2/backtesting/{id}/status` until `completed` or `failed`.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Backtest Workflow

1. Build Aerodrome config and Freqtrade strategy code.
2. Check data availability with `GET https://api.superior.trade/v2/backtesting-data/aerodrome?pair=AERO/USDC&timeframe=5m`.
3. Create a backtest with `POST https://api.superior.trade/v2/backtesting` using `{ "config": {}, "code": "...", "timerange": { "start": "YYYY-MM-DD", "end": "YYYY-MM-DD" } }`.
4. Start it with `PUT https://api.superior.trade/v2/backtesting/{id}/status` and `{ "action": "start" }`.
5. Poll `GET https://api.superior.trade/v2/backtesting/{id}/status` until `completed` or `failed`.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Backtest Workflow

1. Build Aerodrome config and Freqtrade strategy code.
2. Check data availability with `GET https://api.superior.trade/v2/backtesting-data/aerodrome?pair=AERO/USDC&timeframe=5m`.
3. Create a backtest with `POST https://api.superior.trade/v2/backtesting` using `{ "config": {}, "code": "...", "timerange": { "start": "YYYY-MM-DD", "end": "YYYY-MM-DD" } }`.
4. Start it with `PUT https://api.superior.trade/v2/backtesting/{id}/status` and `{ "action": "start" }`.
5. Poll `GET https://api.superior.trade/v2/backtesting/{id}/status` until `completed` or `failed`.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Backtest Workflow

1. Build Aerodrome config and Freqtrade strategy code.
2. Check data availability with `GET https://api.superior.trade/v2/backtesting-data/aerodrome?pair=AERO/USDC&timeframe=5m`.
3. Create a backtest with `POST https://api.superior.trade/v2/backtesting` using `{ "config": {}, "code": "...", "timerange": { "start": "YYYY-MM-DD", "end": "YYYY-MM-DD" } }`.
4. Start it with `PUT https://api.superior.trade/v2/backtesting/{id}/status` and `{ "action": "start" }`.
5. Poll `GET https://api.superior.trade/v2/backtesting/{id}/status` until `completed` or `failed`.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Backtest Workflow

1. Build Aerodrome config and Freqtrade strategy code.
2. Check data availability with `GET https://api.superior.trade/v2/backtesting-data/aerodrome?pair=AERO/USDC&timeframe=5m`.
3. Create a backtest with `POST https://api.superior.trade/v2/backtesting` using `{ "config": {}, "code": "...", "timerange": { "start": "YYYY-MM-DD", "end": "YYYY-MM-DD" } }`.
4. Start it with `PUT https://api.superior.trade/v2/backtesting/{id}/status` and `{ "action": "start" }`.
5. Poll `GET https://api.superior.trade/v2/backtesting/{id}/status` until `completed` or `failed`.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Backtest Workflow

1. Build Aerodrome config and Freqtrade strategy code.
2. Check data availability with `GET https://api.superior.trade/v2/backtesting-data/aerodrome?pair=AERO/USDC&timeframe=5m`.
3. Create a backtest with `POST https://api.superior.trade/v2/backtesting` using `{ "config": {}, "code": "...", "timerange": { "start": "YYYY-MM-DD", "end": "YYYY-MM-DD" } }`.
4. Start it with `PUT https://api.superior.trade/v2/backtesting/{id}/status` and `{ "action": "start" }`.
5. Poll `GET https://api.superior.trade/v2/backtesting/{id}/status` until `completed` or `failed`.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Backtest Workflow

1. Build Aerodrome config and Freqtrade strategy code.
2. Check data availability with `GET https://api.superior.trade/v2/backtesting-data/aerodrome?pair=AERO/USDC&timeframe=5m`.
3. Create a backtest with `POST https://api.superior.trade/v2/backtesting` using `{ "config": {}, "code": "...", "timerange": { "start": "YYYY-MM-DD", "end": "YYYY-MM-DD" } }`.
4. Start it with `PUT https://api.superior.trade/v2/backtesting/{id}/status` and `{ "action": "start" }`.
5. Poll `GET https://api.superior.trade/v2/backtesting/{id}/status` until `completed` or `failed`.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.