Security audit

交易告警通知

Security checks for vulnerabilities and agentic risk

Overview

This skill is framed as a crypto trade-alert helper, but it asks for broad file and shell authority and contains inconsistent claims about external writes and data handling.

Review this before installing. Use it only if you are comfortable granting a trade-alert skill local file mutation and shell-command authority, and configure Binance credentials as read-only with no trading or withdrawal permission. Treat Telegram alert content and chat IDs as data that leaves your environment, and avoid providing secrets unless the runtime gives you clear control over what is sent and executed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The skill claims that API calls are limited to read-only behavior and that it performs no write or trading actions, yet other sections explicitly describe Telegram message sending, file operations, and command execution. This inconsistency is dangerous because users and downstream agents may rely on the safer claim when granting permissions, causing disclosure or side effects they did not meaningfully consent to.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The manifest presents a narrowly scoped trade-alert skill, but later content expands it into a generic file-processing and command-execution capability. This is dangerous because broad undocumented capability creep increases the chance that an agent will invoke powerful operations outside the user's expected trust boundary.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Documenting system command execution for a notification-oriented trading skill is unnecessary and expands the attack surface significantly. In an agent environment with Bash available, this can normalize or justify shell use for tasks that should only require network reads and message delivery, enabling unintended local actions if later operationalized.

Vague Triggers

High

Confidence: 87% confidence
Finding: The invocation description is broad and ambiguous, making it unclear when the skill should or should not be used. Ambiguous routing language is risky in agent systems because it can cause over-invocation of a skill with Read/Write/Edit/Bash permissions, leading to unnecessary exposure of data and capabilities.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill describes Telegram and exchange API integrations that may transmit trading-related data and require credentials, but it does not present a clear upfront warning or consent model for third-party disclosure. This can lead users to unintentionally expose sensitive alert contents, identifiers, or tokens to external services.

Static analysis

No suspicious patterns detected.