Security audit
Security checks for vulnerabilities and agentic risk
This crypto-trading skill is mostly coherent, but it includes live-trading controls and unsafe deployment/update instructions without enough safeguards.
Install only after reviewing the NOFX deployment source yourself, pinning installers/images to immutable releases or checksums, using HTTPS end to end, storing secrets outside shared workspace files, and requiring explicit confirmation before any strategy activation, trader start/stop, exchange API permission change, or fund transfer. Start with testnet or isolated sub-accounts with limited funds and withdrawal permissions disabled.
references/deployment.md:7Unverified Remote Installer Is Piped Directly into Bash
references/faq.md:26FAQ Recommends Executing a Mutable Remote Update Script
references/deployment.md:15Mutable Deployment Definitions and Unpinned Build Dependencies Are Executed
references/faq.md:13FAQ Pulls a Mutable Latest Container Image
scripts/nofx-api.sh:29NOFX API Key Is Exposed in Request URLs
references/webhooks.md:30Telegram Bot Token Is Exposed in Command-Line URL Arguments
The code clearly supports part of the declared description: it integrates with NOFX endpoints for crypto market data, AI signals, fund flow tracking, OI monitoring, and related market analysis. However, the declared purpose is substantially broader than what this code chunk actually does. The script is only a command-line API fetcher for read-oriented data endpoints. It does not implement or expose functionality for strategy creation or management, trader control/management, backtesting, automated reporting, or any AI debate arena features. There is no evidence of order execution, account/trader administration, report generation, or strategy lifecycle operations. So while the description is directionally related, it materially overstates the capabilities present in this supplied code chunk.
The skill instructs an agent to create, save, and activate trading strategies without any safety gating, suitability warning, or explicit confirmation step. In the context of a live crypto trading platform, activating a strategy can directly lead to real-money losses, unintended orders, or autonomous trading behavior based on parsed natural-language instructions.
The trader management section allows creation and starting or stopping traders through browser automation without requiring confirmation or warning about account impact. Because these actions can start autonomous trading or interrupt existing positions and protections, an incorrect or manipulated instruction could cause immediate financial harm.
The pipe into bash removes the user's chance to inspect downloaded content before execution and is a well-known dangerous command-chaining pattern. If the remote content is altered, arbitrary shell commands run immediately on the host.
curl -fsSL https://raw.githubusercontent.com/NoFxAiOS/nofx/main/install.sh | bash
安装完成后访问: http://127.0.0.1:3000
The server deployment section explicitly recommends HTTP with transport encryption disabled by default and does not warn about confidentiality or integrity risks. For a trading platform handling API keys, trader control, and potentially sensitive market actions, unencrypted access can expose credentials, session tokens, and administrative actions to interception or tampering.
The same dangerous curl-to-bash chaining is recommended for server deployment, where compromise is especially serious because the host may be internet-exposed and hold production credentials. Combined with the nearby advice to use HTTP, this increases operational risk for a trading system deployment.
默认禁用传输加密，可直接通过 IP 访问:
curl -fsSL https://raw.githubusercontent.com/NoFxAiOS/nofx/main/install.sh | bash
# 访问: http://YOUR_SERVER_IP:3000
Using a pipe-to-bash chain for updates creates a recurring remote-code-execution workflow, making compromise of the upstream script an efficient way to reach existing installations. This is particularly sensitive in a trading platform context where hosts may store exchange credentials and automation logic.
每日运行以获取最新版本:
curl -fsSL https://raw.githubusercontent.com/NoFxAiOS/nofx/main/install.sh | bash
The pipe into 'bash' turns external content retrieval into immediate execution, removing the opportunity for user inspection and greatly increasing exploitation likelihood. Given this skill supports crypto trading operations, a malicious or compromised script could steal credentials, modify bots, redirect trades, or fully compromise the trading server.
# Re-run installation script
curl -fsSL https://raw.githubusercontent.com/NoFxAiOS/nofx/main/install.sh | bash
The skill includes shell usage examples and operational instructions but does not declare an explicit tool scope such as allowed tools or permissions. That creates an authorization ambiguity where an agent may use shell capabilities more broadly than intended, increasing the chance of unintended command execution or unsafe handling of credentials and trading operations.
The skill tells users to store API and account-related credentials in a workspace file without any secret-handling guidance. Workspace files are commonly readable by tools, agents, logs, backups, or source control, so this pattern increases the likelihood of credential leakage that could expose market data access, browser identity, or potentially linked trading operations.
The guide gives direct instructions to start or stop live traders via browser automation without any warning to verify user intent, confirm account/environment, or require a human approval step. In a crypto trading context, these are consequential actions that can immediately alter live market exposure, so omission of safeguards materially increases the chance of accidental or unauthorized trading changes.
The import/export workflow describes moving strategy JSON without warning about sensitive data exposure, provenance validation, or overwrite risks. In this skill's context, exported strategies may contain proprietary logic or risky configuration, and imported JSON could unintentionally replace settings or introduce unsafe trading behavior if used without review.
The documentation instructs users to fetch a remote shell script and pipe it directly into bash, which executes unreviewed network content immediately. If the upstream repository, CDN path, or transport chain is compromised, users could run arbitrary code with their local privileges without an opportunity to inspect the script first.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# 下载并启动
curl -O https://raw.githubusercontent.com/NoFxAiOS/nofx/main/docker-compose.prod.yml
docker compose -f docker-compose.prod.yml up -d
# 管理命令
The guide tells users to download a remote Docker Compose file and immediately start it, which causes arbitrary container images, ports, volumes, and environment settings from network-fetched content to be trusted by default. A malicious or compromised compose file could start unsafe services, expose secrets, mount sensitive host paths, or run attacker-controlled images.
The Windows instructions repeat the same unsafe pattern of downloading a remote compose file and launching it without review. This can lead users to run untrusted containers and host mappings on their systems with little visibility into what is being started.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
brew install ta-lib
sudo apt-get install libta-lib0-dev
### 安装步骤
The update instructions again tell users to execute a remotely hosted script directly in bash, compounding supply-chain risk because this action is encouraged as a recurring maintenance workflow. Repeated unattended execution increases the blast radius of any compromise of the script source or delivery path.
The document gives step-by-step instructions for creating live trading API keys with trading permissions across multiple exchanges, but it does not clearly warn that these keys can immediately authorize real-money trades and losses if misused, misconfigured, or supplied to an untrusted integration. In a crypto trading skill, this omission is more dangerous because users are likely to follow the steps directly and connect production accounts, increasing the chance of financial loss from operator error, compromised systems, or unsafe downstream tooling.
The FAQ recommends pulling a Docker image using the floating 'latest' tag, which is mutable and can change over time without notice. This weakens supply-chain integrity because users cannot verify they are getting the expected build, and a compromised or accidentally replaced image could be deployed.
The FAQ instructs users to download and immediately execute a remote shell script via 'curl ... | bash' without any integrity verification, review step, or warning. If the GitHub source, transport path, or referenced branch is tampered with, arbitrary code would run on the user's system with the user's privileges.
This document provides detailed leveraged grid-trading configuration examples, expected return calculations, and strategy recommendations without any explicit warning that users can lose all invested capital, that leverage amplifies losses, or that the content is not personalized financial advice. In a trading skill context, omission of these warnings can encourage unsafe real-money use by inexperienced users and materially increases the chance of harmful decision-making.
Lines L098-L100 instruct the user to create sub-accounts and transfer funds, which can affect user assets and may be difficult to reverse if done incorrectly. The document provides procedural steps but no warning to confirm account identity, amounts, or exchange-side implications before moving funds.
The configuration schema sets "language": "zh" as a fixed value in the example, which indicates a locale/language constraint without any user opt-in or explanation. This matches the policy concern for forcing a specific language unless the skill offers choice or documents a justified regional scope.
The second strategy example again hard-codes "language": "zh", reinforcing a forced locale behavior rather than presenting language as user-selectable. Because no opt-in, alternatives, or regional justification are provided in the surrounding text, this is a natural-language policy violation.
No suspicious patterns detected.