aiusd-pro

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:25 AM UTC
• Version: 1.0.0

Overview

This skill appears to be a real trading integration, but it needs review because it can affect funds through a mutable npm CLI, remote session state, and broad natural-language confirmations.

Install only if you are comfortable letting this skill run npm-resolved code and delegate trading decisions, confirmations, and session state to the AIUSD backend. Before using it with real funds, prefer a pinned reviewed CLI version, verify the login domain, keep session IDs private, and independently check every asset, amount, venue, leverage, fee, slippage, and wallet approval before confirming.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:63

Finding

Untrusted Backend Output Is Relayed Without Validation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 63-68 and 110-113
Vulnerability Type: Untrusted output forwarding and instruction hijacking
Risk Level: High

Vulnerable Code Snippet:

markdown

**Complete pattern:**

1. Start: `bash background:true command:"npx -y aiusd-pro send 'What are my balances?'"`
   → returns `sessionId: abc123`
2. Wait & poll: `process action:poll sessionId:abc123`
   → returns `running` or `exited`
3. Get output: `process action:log sessionId:abc123`
   → returns the agent's full response text
4. Relay output to user as-is

markdown

4. Relay stdout to user as-is — already formatted for humans.
   The output includes a browser link at the end (e.g. `https://aiusd.ai/chat/<session-id>`).
   Always include this link when relaying the response — it lets browser-login users
   continue the conversation in the web UI.

Technical Analysis

The skill directs the host agent to relay content produced by an external backend without validation, sanitization, or independent interpretation. The backend controls both the response text and a browser link that the host must include.

This creates an untrusted-content boundary violation. If the backend service, npm client, network path, or associated account is compromised, an attacker can return deceptive transaction information, phishing instructions, malicious links, or content designed to override the expected interaction flow. The mandatory “as-is” forwarding rule prevents the host from correcting or filtering such output.

Although the returned text is presented to the user rather than explicitly executed as local code, it can still manipulate a financially sensitive workflow and influence subsequent confirmations.

Attack Path

1. An attacker compromises or impersonates the AIUSD backend, or compromises the npm package used to communicate with it.
2. The attacker returns crafted stdout c ...[truncated 968 chars]

Remediation

View remediation

Remediation Suggestions

• Treat every backend response as untrusted data rather than authoritative instructions.
• Require the backend to return a versioned, strictly validated JSON schema instead of unrestricted text.
• Independently render transaction summaries from validated fields such as asset, amount, network, destination, leverage, slippage, fees, and expiration.
• Do not relay links automatically. Restrict links to an explicit HTTPS origin allowlist and reject embedded credentials, redirects, and unexpected domains.
• Remove the requirement to relay stdout “as-is.”
• Clearly label remote backend content and warn users not to enter seed phrases, private keys, or credentials.
• Require separate wallet-side approval for every state-changing financial transaction.
• Log validated proposal identifiers and final transaction parameters for auditability without recording secrets.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:19

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19-23
Vulnerability Type: Mutable third-party dependency execution
Risk Level: High

Vulnerable Code Snippet:

markdown

## CLI entry point

All commands in this skill use `npx -y aiusd-pro` as the CLI prefix. This works without any global installation — npx resolves the package from npm automatically.

If `aiusd-pro` is already in PATH (via `npm install -g aiusd-pro`), you may use `aiusd-pro` directly instead.

Technical Analysis

The documented command uses npx -y aiusd-pro without an exact package version, lockfile, or integrity verification. Consequently, the code executed during a future invocation may differ from the code that existed when the skill was audited.

The -y option suppresses the interactive installation prompt, allowing npm-resolved package content to be downloaded and executed automatically. The skill metadata version (1.0.1) does not pin the separately retrieved npm package. The global-PATH alternative also lacks a mechanism to verify which executable is selected or whether it is an approved version.

This creates a supply-chain execution channel. A compromised npm publisher account, malicious future release, registry compromise, or untrusted executable earlier in PATH could result in attacker-controlled code running with the host agent’s privileges.

Attack Path

1. An attacker compromises the npm publisher account, package distribution process, or an applicable registry configuration.
2. The attacker publishes a malicious release under the expected aiusd-pro package name.
3. A host invokes a documented command using npx -y aiusd-pro.
4. npm resolves and downloads the mutable package release without requesting user confirmation.
5. Package lifecycle behavior or the CLI entry point executes attacker-controlled JavaScript.
6. The malicious process accesses resources available to the agent, such as environ ...[truncated 715 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to an exact reviewed version, such as aiusd-pro@1.0.1, rather than relying on the latest registry resolution.
• Commit and enforce a lockfile containing verified integrity hashes.
• Install the reviewed package during a controlled build phase instead of downloading executable code during each skill invocation.
• Verify package provenance, publisher identity, signatures, and registry origin.
• Disable or tightly control package lifecycle scripts where feasible.
• Do not fall back to an arbitrary executable from PATH; resolve a known installation path and verify its version and integrity.
• Run the CLI in a sandbox with minimal filesystem access, restricted environment variables, and narrowly allowlisted network destinations.
• Continuously monitor the dependency for ownership changes, unexpected releases, and known vulnerabilities.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:71

Finding

Ambiguous Confirmations Are Delegated to a Persistent Remote Trading Session

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 71-84 and 106-115
Vulnerability Type: Insufficient authorization binding for financial operations
Risk Level: High

Vulnerable Code Snippet:

markdown

### Multi-turn conversation

Session context is maintained automatically across `send` calls.
The backend agent remembers all previous messages in the session.

**Confirmation flow example:**

1. `bash background:true command:"npx -y aiusd-pro send 'Buy 100 USDC worth of SOL'"`
2. Poll + log → agent responds: "Will buy ~0.65 SOL at $153. Confirm?"
3. Relay to user, user says "yes"
4. `bash background:true command:"npx -y aiusd-pro send 'yes'"`
5. Poll + log → agent responds: "Done. TX: abc123..."
6. Relay to user

markdown

2. Pass user intent as natural language — do NOT interpret or construct
   specific trading commands.
3. Backend agent handles all domain knowledge, tool selection, and
   multi-step reasoning.
4. Relay stdout to user as-is — already formatted for humans.
5. If response asks for confirmation or more info, relay to user,
   then `send` their reply back (same session, same pattern).
6. Run commands sequentially — only one active `send` per session.

Technical Analysis

The confirmation procedure forwards a generic response such as yes into a persistent backend session. The confirmation is not cryptographically or structurally bound to a specific transaction proposal, exact parameters, expiration time, or authenticated user action.

The host is also instructed not to interpret the request and to delegate domain knowledge, tool selection, and multi-step reasoning to the backend. No local control verifies the asset, amount, network, venue, destination, leverage, slippage, fees, or proposal freshness immediately before execution.

Because session context is maintained automatically, stale state, session confusion, unexpected backend behavior, or a co ...[truncated 1319 chars]

Remediation

View remediation

Remediation Suggestions

• Replace generic natural-language confirmations with explicit, structured transaction proposals.
• Assign every proposal a unique identifier, immutable parameter hash, expiration time, and authenticated session binding.
• Require confirmation to reference the proposal identifier and repeat all material terms.
• Independently display and verify asset, amount, network, venue, recipient, leverage, liquidation risk, fees, slippage, and expected output.
• Reject stale confirmations and invalidate a proposal whenever any transaction parameter changes.
• Permit only one pending state-changing proposal per isolated user session.
• Apply configurable spending, leverage, slippage, and token-allowance limits outside the backend agent.
• Require final wallet-side or hardware-wallet approval for every transaction.
• Provide a clear session reset and pending-operation cancellation mechanism before accepting a new request.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill markets natural-language trading but does not prominently warn that it can place real trades, manage positions, and affect funds. In a financial context, this omission is dangerous because users or orchestrating agents may treat it as informational chat rather than a tool that can trigger irreversible economic actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill repeatedly instructs the agent to execute npx -y aiusd-pro without pinning a specific package version. Because npx fetches the latest package from npm at runtime, a compromised publisher account, malicious update, or dependency hijack could cause arbitrary code execution in the agent environment before any trading action occurs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill repeatedly instructs the agent to execute npx -y aiusd-pro without pinning a specific package version. Because npx fetches the latest package from npm at runtime, a compromised publisher account, malicious update, or dependency hijack could cause arbitrary code execution in the agent environment before any trading action occurs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill says to use it for 'anything related to AIUSD or trading through natural conversation,' which is overly broad for a tool capable of account access and fund-affecting actions. Broad invocation criteria raise the chance an agent routes ambiguous user requests into a live trading backend without clear user intent, increasing accidental or unauthorized actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This login command uses npx -y aiusd-pro without a pinned version in an authentication flow. That makes the risk more severe because a malicious package update could intercept login material, browser-auth session identifiers, or execute arbitrary code while the operator believes they are only initiating sign-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The authentication instructions tell the operator to send the login URL and handle session_id values through the conversation without a privacy or secrecy warning. In practice, session identifiers and auth URLs can be sensitive, and normalizing their relay through chat may expose them to logs, unintended recipients, or downstream systems.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The polling login session command is also executed via an unpinned npx package. In a security-sensitive auth context, this exposes the environment to supply-chain compromise that could capture session IDs or alter the login flow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The primary send operation invokes npx -y aiusd-pro without version pinning. Because this command is the main pathway for delegated backend reasoning and trading-related actions, an attacker controlling the published package could gain arbitrary code execution and potentially manipulate financial workflows or exfiltrate data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This example again directs runtime execution of an unpinned npm package for a balances query. Even seemingly read-only account operations can expose wallet, account, and session data if the fetched package is malicious or trojanized.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The confirmation-flow example uses the same unpinned package execution for trading. In this context, the supply-chain risk combines with a funds-moving workflow, making malicious tampering especially dangerous because it could alter prompts, transaction parameters, or wallet interactions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This follow-up send 'yes' confirmation is executed through an unpinned package in a live trade-confirmation path. A compromised package could weaponize confirmations, misrepresent outcomes, or initiate unauthorized actions when the operator expects a narrow confirmation step.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The session reset command is still an unpinned runtime package execution. Although lower impact than login or trade placement, a malicious package fetched during session management could still execute arbitrary code or tamper with conversation state and data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The cancel command uses the same unpinned npx package pattern. Any mutable package execution in an environment handling authenticated sessions and trading actions creates unnecessary supply-chain exposure, even for supposedly simple control commands.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The session new command executes an unpinned npm package at runtime. This remains a true supply-chain risk because an attacker could exploit any invocation path to run arbitrary code or manipulate session handling.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The session list example repeats the unpinned npx invocation pattern. Repetition across the document increases operational likelihood that agents will execute mutable code frequently, enlarging the window for supply-chain compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The session reset example again relies on an unpinned package fetched from npm. In aggregate with the rest of the skill, this creates systemic supply-chain risk across authentication, messaging, and trading functions.

Content

No source excerpt is available for this finding.