Kraken

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:40 AM UTC
• Version: 1.1.2

Overview

This skill accesses sensitive Kraken account data, but its behavior is disclosed, purpose-aligned, and mostly read-only.

Install only if you are comfortable letting the agent query Kraken account, order, ledger, earn, and deposit-address data. Use a minimally scoped Kraken API key with no trading or withdrawal permissions, protect any .env file, avoid pasting secrets into chat, and prefer pinned or locked dependency versions before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned and Unverified Runtime Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, lines 1–2
Vulnerability Type: Unpinned dependencies without integrity verification
Risk Level: Medium

text

python-kraken-sdk>=1.2.0
python-dotenv>=1.0.0

Technical Analysis

Both runtime dependencies use open-ended minimum-version constraints. Consequently, future installations may resolve to package versions that were not reviewed as part of this audit. The requirements file also provides no cryptographic hashes to verify package integrity.

This is security-sensitive because python-kraken-sdk is initialized with Kraken API credentials and can access private financial account information. If a permitted future release or its transitive dependency is compromised, malicious code could execute during package installation or module import. The finding represents supply-chain exposure; the audit found no evidence that the currently named packages are malicious.

Attack Path

1. An attacker compromises a future release of one of the permitted packages or a transitive dependency.
2. The malicious release remains compatible with the unrestricted >= constraint.
3. A user installs or updates the project dependencies from requirements.txt.
4. The package installer resolves and installs the compromised release because no exact version or integrity hash is enforced.
5. Malicious code executes during installation or when the project imports the dependency.
6. The code can access the process environment and the Kraken credentials supplied to the SDK, as well as account data available under those credentials.

Impact Assessment

Successful exploitation would run dependency code with the privileges of the user installing or executing the project. It could expose KRAKEN_API_KEY, KRAKEN_API_SECRET, and financial account information; manipulate displayed portfolio data; or perform any Kraken API operation allowed by the configured key permissions. Local files and other resource ...[truncated 234 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace minimum-version ranges with exact, reviewed versions using ==.
2. Generate a reproducible lockfile containing cryptographic hashes, for example with pip-compile --generate-hashes.
3. Enforce hash verification during deployment with pip install --require-hashes.
4. Pin and review transitive dependencies, not only the two direct dependencies.
5. Install packages only from an explicitly configured, trusted package index.
6. Add automated dependency vulnerability and provenance scanning to CI.
7. Regularly update dependencies through a controlled review process rather than accepting arbitrary future releases.
8. Configure the Kraken API key with only the minimum read permissions required by the Skill and disable trading or withdrawal permissions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 90% confidence

Finding

The code spawns a secondary Python process and forwards user-controlled arguments directly to kraken_api.py. Although it avoids shell=True and is not classic shell injection, it still exposes a command-execution boundary to a downstream script that may perform sensitive Kraken API actions, making this a real capability-expansion risk.

Content

Scanner excerpt · kraken_cli.py (reported line 412)May include surrounding context.

python

"""Pass through to kraken_api.py for raw commands."""
    import subprocess
    api_script = os.path.join(skill_dir, "kraken_api.py")
    result = subprocess.run(
        ["python", api_script] + args,
        capture_output=True,
        text=True,

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file is presented as a high-level portfolio wrapper, but it intentionally exposes unrestricted raw API passthrough. In a skill/agent context, this can let users or chained prompts invoke unintended low-level actions through loaded exchange credentials, defeating the safer abstraction implied by the interface.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Unknown commands are silently forwarded to the raw API layer for backward compatibility, which undermines the stated high-level-only design. This increases the chance that an agent, user, or prompt injection can reach privileged functionality without an explicit opt-in boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs users to place Kraken API credentials in environment variables or a local .env file but does not warn that these are highly sensitive secrets or that subsequent private-account commands may expose personal financial data. In an agent skill context, this omission is risky because users may assume the setup is routine and may provide live exchange credentials without understanding logging, command-history, filesystem, or downstream tool exposure risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The raw passthrough executes another script with user-supplied arguments and no warning or policy enforcement around downstream effects. In this context, that means potentially sensitive authenticated exchange operations can be triggered through a wrapper that appears focused on portfolio viewing.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The dependency is specified with a lower-bound only (>=1.2.0), which allows installation of any future version, including unreviewed releases that may introduce breaking changes or supply-chain risk. While not an exploit by itself, unpinned dependencies reduce build reproducibility and make it easier for vulnerable or malicious upstream versions to be pulled in unexpectedly.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

python-kraken-sdk>=1.2.0
python-dotenv>=1.0.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The package is unpinned with only a minimum version, so installs are non-reproducible and may resolve to vulnerable or incompatible releases. In this case the risk is elevated because the same file also indicates a known vulnerable version of python-dotenv, showing dependency hygiene issues around a package commonly used to load secrets and environment configuration.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

python-kraken-sdk>=1.2.0
python-dotenv>=1.0.0

Known Vulnerable Dependency: python-dotenv==1.0.0 — 2 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)

Medium

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The static finding identifies python-dotenv 1.0.0 as affected by a symlink-following issue in set_key that can enable arbitrary file overwrite in workflows that modify .env files. This is especially relevant for skills that may handle local configuration or secrets, because a vulnerable dotenv utility can be abused to tamper with files or expose sensitive environment configuration if the affected code paths are used.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.