Security audit

交易告警通知

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent trade-alert purpose, but it asks for broad local tools and makes inconsistent claims about external messaging, logging, and data handling.

Review before installing. Use this only if you are comfortable granting a trade-alert skill access to local file tools, Bash, API credentials, Binance market data, and Telegram message sending. Prefer a version that removes generic command/file capabilities or clearly limits them, and avoid giving Binance trade or withdrawal permissions.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill manifest presents a narrowly scoped trade-alert capability, but later documentation expands into generic file processing, API integration, and command execution. This scope drift can cause an agent or user to authorize broader actions than expected, increasing the chance of unsafe tool use and violating least-privilege expectations.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The document states that API calls are limited to read-only operations, yet Telegram notification delivery is inherently a write action to a third-party service. This misrepresentation can mislead users and the hosting agent about the actual data flow and side effects, causing unauthorized outbound messaging or disclosure of alert contents.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The skill claims all processing is local and that no user privacy data is transmitted externally, but the rest of the document repeatedly describes Binance and Telegram API usage. These contradictory statements hide real third-party data transfers, undermining informed consent and making exfiltration or privacy violations easier to disguise.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill says user data is only kept in memory and never persisted, but also says all external API calls are logged. If logs contain request metadata, identifiers, or message content, then data is in fact being persisted, creating retention and leakage risks that contradict the stated privacy model.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Including command-execution capability in a trade-alert skill is not justified by the stated business purpose and materially increases attack surface. In an agent environment with Bash available, this can enable arbitrary local actions, filesystem changes, or network pivoting if the skill is triggered or interpreted too broadly.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The activation guidance is broad enough to match generic trading-related requests rather than only alert-notification tasks. Overbroad routing increases the chance that the skill is invoked in contexts where its external API use, file writes, or command capabilities are unnecessary or unsafe.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The markdown advertises command execution, file handling, and external API use without a clear warning that third-party transmission, file writes, or system commands may occur. Users may unknowingly authorize sensitive side effects, especially because the skill earlier makes reassuring but inconsistent privacy and safety claims.

Static analysis

No suspicious patterns detected.