Security audit

Position Tracker

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate position/state tracking helper, but its optional cleanup features can affect real external resources if wired to powerful APIs.

Install only if you need external state reconciliation. Test first with sandbox or read-only credentials, keep auto_close disabled until manually validated, use narrowly scoped API keys, review detected orphans before closing anything, and protect the local state file because it may contain sensitive position metadata.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README describes orphan cleanup in a way that normalizes self-healing actions against external systems, but it does not place a prominent warning next to the behavior that cleanup may modify or close real external positions/resources. In this context, the skill is explicitly marketed for brokers, exchanges, cloud resources, subscriptions, and other billable systems, so an operator could enable cleanup assuming it is harmless and unintentionally trigger destructive external actions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The advanced configuration documents enable_auto_reconcile=True as an ordinary option without a strong nearby warning that automatic reconciliation may perform state-changing corrections against external systems. Because the advertised use cases include trading, cloud instances, subscriptions, and quota/session management, auto-fix behavior could terminate or alter real assets, services, or billing state if reconciliation logic is wrong or races with external updates.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The API reference states that cleanup_orphans(..., auto_close=True) may close positions via the API adapter, but it does not strongly emphasize that this can directly close live external positions/resources. In a generalized skill that can target financial positions, cloud instances, subscriptions, or sessions, this creates a real risk of unexpected destructive actions from a seemingly routine cleanup call.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The front-matter description uses very broad activation language like 'any exchange, broker, or external system' and 'any stateful bot,' which can cause the skill to be selected for unrelated contexts. Overbroad matching is dangerous because this skill includes reconciliation and cleanup behaviors that may influence handling of real external resources outside the author's intended domain.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The documentation repeatedly claims applicability to 'any' domain, which expands the apparent operating scope without defining safety boundaries. In an agent ecosystem, this increases the chance the skill is invoked in high-risk environments where automatic reconciliation or cleanup could affect production assets, subscriptions, or infrastructure.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The API reference presents 'cleanup_orphans(..., auto_close=True)' as an available feature without a prominent warning that it may close real positions or other external resources. This is dangerous because readers may treat cleanup as routine reconciliation and enable destructive actions against live broker, cloud, or subscription systems.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The cloud-resource and subscription examples normalize auto-cleanup of real-world assets without clearly warning that this could terminate instances, cancel subscriptions, or delete billable resources. Because the skill is framed as generalized and self-healing, operators may over-trust it and permit destructive automation in production environments.

Missing User Warnings

High

Confidence: 96% confidence
Finding: cleanup_orphans() can invoke api.close_position() on externally held positions when auto_close=True, which is a real destructive action against an external system. Because the method interface does not enforce confirmation, authorization checks, dry-run mode, or strong audit signaling, a caller can accidentally or improperly trigger irreversible position closure and cause loss of assets or service disruption.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.