Orderly Trading Orders

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:55 AM UTC
• Version: 1.0.0

Overview

This skill is coherent trading documentation, but it teaches live order placement and broad order cancellation without enough warnings or confirmation guidance for financial actions.

Review before installing if you may let an agent act on trading instructions. Use only testnet or low-permission keys where possible, require human confirmation before placing, editing, canceling, batch-canceling, or canceling all orders, and avoid unscoped cancel-all operations.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 93% confidence

Finding

The skill exposes a destructive order-cancellation endpoint with attacker- or user-controlled identifiers and no accompanying guardrails, confirmation flow, or validation guidance. In an agent context, ambiguous or untrusted parameters could be propagated directly into a live cancellation action, resulting in unauthorized or unintended removal of open orders.

Content

Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.

typescript

// REST API
DELETE /v1/order?order_id={order_id}&symbol={symbol}

// React SDK
import { useOrderStream } from '@orderly.network/hooks';

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Cancel-all functionality is highly destructive and is presented without strong warnings, approval requirements, or safer defaults. In live trading, misuse could instantly remove all working orders for a symbol or account, including protective or hedging orders, causing immediate financial exposure.

Content

Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.

typescript

// REST API - Cancel all open orders
DELETE /v1/orders?symbol={symbol}  // Optional symbol filter

// React SDK
const [orders, { cancelAllOrders }] = useOrderStream();

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

Cancellation by client order ID is a sensitive state-changing operation, and the documentation does not pair it with checks that the supplied ID is intended, recent, and owned by the current account context. In agent workflows, this can enable accidental or manipulated cancellation of the wrong order when parameters are derived from ambiguous prompts or untrusted sources.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

Cancel by Client Order ID

typescript

DELETE /v1/client/order?client_order_id={client_order_id}&symbol={symbol}

Batch Orders

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

Batch cancellation amplifies the impact of parameter abuse because one malformed or manipulated request can remove multiple live orders at once. Without validation, previews, or explicit confirmation, an agent could be induced to cancel a large set of orders, causing immediate trading disruption and financial loss.

Content

Scanner excerpt · SKILL.md (reported line 294)May include surrounding context.

md

}

// Batch cancel (max 10 orders)
DELETE /v1/batch-order?order_ids={id1},{id2},...

// Example
const batchResponse = await fetch('https://api.orderly.org/v1/batch-order', {

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 391)May include surrounding context.

md

| Endpoint               | Rate Limit |
| ---------------------- | ---------- |
| POST /v1/order         | 10 req/sec |
| DELETE /v1/order       | 10 req/sec |
| PUT /v1/order          | 10 req/sec |
| POST /v1/batch-order   | 1 req/sec  |
| DELETE /v1/batch-order | 10 req/sec |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 394)May include surrounding context.

md

| DELETE /v1/order       | 10 req/sec |
| PUT /v1/order          | 10 req/sec |
| POST /v1/batch-order   | 1 req/sec  |
| DELETE /v1/batch-order | 10 req/sec |

## Order Status Flow

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The order placement examples directly submit signed requests to the live trading API without a clear warning that they execute real trades. In a financial trading skill, omission of that warning materially increases the chance of accidental market activity, unintended fills, and direct monetary loss.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

const base64 = btoa(String.fromCharCode(...signature));
  const base64url = base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');

  const response = await fetch('https://api.orderly.org/v1/order', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

const base64 = btoa(String.fromCharCode(...signature));
  const base64url = base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');

  const response = await fetch('https://api.orderly.org/v1/order', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md

const base64 = btoa(String.fromCharCode(...signature));
  const base64url = base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');

  const response = await fetch('https://api.orderly.org/v1/order', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.

md

const base64 = btoa(String.fromCharCode(...signature));
  const base64url = base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');

  const response = await fetch('https://api.orderly.org/v1/order', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents destructive cancellation operations, including cancel-all behavior, without requiring confirmation, scoping guidance, or an explicit warning that these calls immediately affect live open orders. In a trading context, this is dangerous because an agent or user could unintentionally liquidate trading intent, disrupt hedges, or cancel protective orders, causing real financial harm.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.

md

DELETE /v1/batch-order?order_ids={id1},{id2},...

// Example
const batchResponse = await fetch('https://api.orderly.org/v1/batch-order', {
  method: 'POST',
  headers: { /* auth headers */ },
  body: JSON.stringify({

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description scopes the skill to order placement/management/cancellation and explicitly lists standard order types plus batch operations. The file additionally includes creation of algorithmic TP/SL-style orders, which is a separate capability and is even described as belonging to another skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Lines L372-L372 direct readers to the orderly-positions-tpsl skill for take-profit and stop-loss orders. However, the following example documents POST /v1/algo/order with a TAKE_PROFIT payload, contradicting that guidance and blurring intended skill boundaries.

Content

No source excerpt is available for this finding.