Orderly Trading Orders

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:55 AM UTC
• Version: 1.0.0

Overview

This skill is coherent trading documentation, but it teaches live order placement and broad order cancellation without enough warnings or confirmation guidance for financial actions.

Review before installing if you may let an agent act on trading instructions. Use only testnet or low-permission keys where possible, require human confirmation before placing, editing, canceling, batch-canceling, or canceling all orders, and avoid unscoped cancel-all operations.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```typescript
// REST API
DELETE /v1/order?order_id={order_id}&symbol={symbol}

// React SDK
import { useOrderStream } from '@orderly.network/hooks';

• Confidence: 93% confidence
• Finding: The skill exposes a destructive order-cancellation endpoint with attacker- or user-controlled identifiers and no accompanying guardrails, confirmation flow, or validation guidance. In an agent context, ambiguous or untrusted parameters could be propagated directly into a live cancellation action, resulting in unauthorized or unintended removal of open orders.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```typescript
// REST API - Cancel all open orders
DELETE /v1/orders?symbol={symbol}  // Optional symbol filter

// React SDK
const [orders, { cancelAllOrders }] = useOrderStream();

• Confidence: 97% confidence
• Finding: Cancel-all functionality is highly destructive and is presented without strong warnings, approval requirements, or safer defaults. In live trading, misuse could instantly remove all working orders for a symbol or account, including protective or hedging orders, causing immediate financial exposure.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Cancel by Client Order ID

```typescript
DELETE /v1/client/order?client_order_id={client_order_id}&symbol={symbol}
```

## Batch Orders

• Confidence: 91% confidence
• Finding: Cancellation by client order ID is a sensitive state-changing operation, and the documentation does not pair it with checks that the supplied ID is intended, recent, and owned by the current account context. In agent workflows, this can enable accidental or manipulated cancellation of the wrong order when parameters are derived from ambiguous prompts or untrusted sources.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

}

// Batch cancel (max 10 orders)
DELETE /v1/batch-order?order_ids={id1},{id2},...

// Example
const batchResponse = await fetch('https://api.orderly.org/v1/batch-order', {

• Confidence: 94% confidence
• Finding: Batch cancellation amplifies the impact of parameter abuse because one malformed or manipulated request can remove multiple live orders at once. Without validation, previews, or explicit confirmation, an agent could be induced to cancel a large set of orders, causing immediate trading disruption and financial loss.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| Endpoint               | Rate Limit |
| ---------------------- | ---------- |
| POST /v1/order         | 10 req/sec |
| DELETE /v1/order       | 10 req/sec |
| PUT /v1/order          | 10 req/sec |
| POST /v1/batch-order   | 1 req/sec  |
| DELETE /v1/batch-order | 10 req/sec |

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| DELETE /v1/order       | 10 req/sec |
| PUT /v1/order          | 10 req/sec |
| POST /v1/batch-order   | 1 req/sec  |
| DELETE /v1/batch-order | 10 req/sec |

## Order Status Flow

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The order placement examples directly submit signed requests to the live trading API without a clear warning that they execute real trades. In a financial trading skill, omission of that warning materially increases the chance of accidental market activity, unintended fills, and direct monetary loss.

External Transmission

Medium

• Category: Data Exfiltration

Content

const base64 = btoa(String.fromCharCode(...signature));
  const base64url = base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');

  const response = await fetch('https://api.orderly.org/v1/order', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

const base64 = btoa(String.fromCharCode(...signature));
  const base64url = base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');

  const response = await fetch('https://api.orderly.org/v1/order', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

const base64 = btoa(String.fromCharCode(...signature));
  const base64url = base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');

  const response = await fetch('https://api.orderly.org/v1/order', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

const base64 = btoa(String.fromCharCode(...signature));
  const base64url = base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');

  const response = await fetch('https://api.orderly.org/v1/order', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill documents destructive cancellation operations, including cancel-all behavior, without requiring confirmation, scoping guidance, or an explicit warning that these calls immediately affect live open orders. In a trading context, this is dangerous because an agent or user could unintentionally liquidate trading intent, disrupt hedges, or cancel protective orders, causing real financial harm.

External Transmission

Medium

• Category: Data Exfiltration

Content

DELETE /v1/batch-order?order_ids={id1},{id2},...

// Example
const batchResponse = await fetch('https://api.orderly.org/v1/batch-order', {
  method: 'POST',
  headers: { /* auth headers */ },
  body: JSON.stringify({

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The manifest description scopes the skill to order placement/management/cancellation and explicitly lists standard order types plus batch operations. The file additionally includes creation of algorithmic TP/SL-style orders, which is a separate capability and is even described as belonging to another skill.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: Lines L372-L372 direct readers to the `orderly-positions-tpsl` skill for take-profit and stop-loss orders. However, the following example documents `POST /v1/algo/order` with a `TAKE_PROFIT` payload, contradicting that guidance and blurring intended skill boundaries.

Static analysis

No suspicious patterns detected.