NOFX AI Trading

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:49 PM UTC
• Version: 1.1.0

Overview

This crypto-trading skill is mostly coherent, but it includes live-trading controls and unsafe deployment/update instructions without enough safeguards.

Install only after reviewing the NOFX deployment source yourself, pinning installers/images to immutable releases or checksums, using HTTPS end to end, storing secrets outside shared workspace files, and requiring explicit confirmation before any strategy activation, trader start/stop, exchange API permission change, or fund transfer. Start with testnet or isolated sub-accounts with limited funds and withdrawal permissions disabled.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/deployment.md:7
• Finding: Unverified Remote Installer Is Piped Directly into Bash<![CDATA[ ## Vulnerability Details **File Location**: `references/deployment.md:7-8`, `references/deployment.md:94-95`, and `references/deployment.md:111-112` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://raw.githubusercontent.com/NoFxAiOS/nofx/main/install.sh | bash ``` The same command is presented for initial installation, server deployment, and daily updates. ### Technical Analysis The command retrieves `install.sh` from the mutable `main` branch and sends its contents directly to Bash. The downloaded script is not included in the audited package, pinned to an immutable commit, or checked against a cryptographic hash or signature. The effective code executed by users can therefore change at any time after this Skill has been reviewed. Hosting the script on GitHub does not establish the integrity of future content. Compromise of the upstream account, repository, branch, or delivery chain could turn the documented installation command into an arbitrary code-execution mechanism. Direct piping also removes the normal review boundary that would exist if users downloaded and inspected the script before execution. ### Attack Path 1. An attacker compromises the upstream repository or obtains permission to modify `install.sh` on the `main` branch. 2. The attacker adds credential theft, persistence, destructive commands, or another malicious payload to the installer. 3. A user or AI agent follows the deployment or update instructions. 4. `curl` retrieves the attacker-controlled version. 5. Bash executes the response immediately without checksum validation or user inspection. 6. The payload receives all privileges held by the invoking user and may interact with Docker, local configuration, network services, and trading credentials. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user running the inst ...[truncated 556 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove every pipe-to-shell installation and update command. 2. Pin the installer to an immutable, reviewed commit or versioned release. 3. Download the installer to a local file rather than executing the HTTP response directly. 4. Publish and verify a SHA-256 checksum or cryptographic signature before execution. 5. Instruct users to inspect the downloaded script before running it. 6. Execute installation using an unprivileged service account where possible. 7. Document any required Docker, filesystem, network, or administrative permissions. 8. Prefer vendoring a reviewed installer in the Skill package when licensing and maintenance requirements permit it. 9. Never use an automatically changing branch for unattended daily updates. A safer workflow would resemble: ```bash curl -fLo install.sh "https://raw.githubusercontent.com/NoFxAiOS/nofx/<reviewed-commit>/install.sh" echo "<expected-sha256> install.sh" | sha256sum -c - less install.sh bash install.sh ``` ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/faq.md:26
• Finding: FAQ Recommends Executing a Mutable Remote Update Script<![CDATA[ ## Vulnerability Details **File Location**: `references/faq.md:26-28` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```bash # Re-run installation script curl -fsSL https://raw.githubusercontent.com/NoFxAiOS/nofx/main/install.sh | bash ``` ### Technical Analysis The update procedure executes code from a mutable upstream branch without pinning, signature verification, checksum validation, or local inspection. An update path is particularly sensitive because users may run it repeatedly and may treat it as a routine recovery action. The contents of `install.sh` are outside the audited package. As a result, the package cannot guarantee what commands this instruction will execute in the future. ### Attack Path 1. An attacker modifies or replaces the installer on the upstream `main` branch. 2. A user experiencing an update or installation issue follows the FAQ. 3. The remote response is streamed directly into Bash. 4. The attacker-controlled commands execute with the user's current privileges. 5. The payload can access local files, Docker resources, credentials, and reachable services. ### Impact Assessment The impact is arbitrary code execution under the invoking account. In a deployment environment containing exchange API keys and automated trading services, this can lead to credential theft, unauthorized orders, strategy manipulation, service compromise, or host takeover. The behavior is not required for answering FAQ questions and violates least-privilege and supply-chain integrity principles. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions Replace the command with a versioned update procedure that: 1. Uses a specific release or immutable commit. 2. Downloads the installer without executing it. 3. Verifies a project-published signature or checksum. 4. Displays the script for review. 5. Runs it only after explicit user approval. 6. Documents rollback and backup procedures. 7. Avoids unattended updates from a mutable branch. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/deployment.md:15
• Finding: Mutable Deployment Definitions and Unpinned Build Dependencies Are Executed<![CDATA[ ## Vulnerability Details **File Location**: `references/deployment.md:15-18`, `references/deployment.md:37-40`, and `references/deployment.md:70-79` **Vulnerability Type**: Unpinned remote deployment artifacts and dependencies **Risk Level**: High ### Vulnerable Code ```bash # Download and start curl -O https://raw.githubusercontent.com/NoFxAiOS/nofx/main/docker-compose.prod.yml docker compose -f docker-compose.prod.yml up -d ``` ```powershell curl -o docker-compose.prod.yml https://raw.githubusercontent.com/NoFxAiOS/nofx/main/docker-compose.prod.yml docker compose -f docker-compose.prod.yml up -d ``` ```bash # 1. Clone repository git clone https://github.com/NoFxAiOS/nofx.git cd nofx # 2. Install backend dependencies go mod download # 3. Install frontend dependencies cd web && npm install && cd .. ``` ### Technical Analysis The Compose definition is downloaded from the mutable `main` branch and immediately used to start containers. No commit pin, checksum, signature, or manual inspection step is required. A modified Compose file could select attacker-controlled images, add privileged options, mount sensitive host paths, publish unexpected ports, or change environment and network settings. The manual build procedure similarly clones the repository's current default branch and downloads Go and npm dependencies without identifying a reviewed commit or requiring verified lockfiles. This leaves the installed result dependent on upstream state at execution time rather than audit time. ### Attack Path 1. An attacker compromises the upstream repository, a dependency account, or an artifact referenced by the Compose or dependency manifests. 2. The attacker modifies the Compose definition, source tree, image reference, or dependency version. 3. A user downloads the current `main` branch or clones the current default branch. 4. Docker Compose starts the altered services, or Go/npm retrieves and processes the altered dependencies. 5. Malicious code exe ...[truncated 736 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the Compose file to a reviewed commit or signed release. 2. Publish a checksum or signature for the Compose file and verify it before use. 3. Require users to inspect the resolved configuration with: ```bash docker compose -f docker-compose.prod.yml config ``` 4. Pin every container image to an immutable digest rather than a mutable tag. 5. Avoid privileged containers, host networking, broad host mounts, and Docker socket exposure. 6. Clone a specific reviewed commit: ```bash git clone https://github.com/NoFxAiOS/nofx.git cd nofx git checkout <reviewed-commit> ``` 7. Require committed and reviewed Go and npm lockfiles. 8. Use reproducible installation commands such as `npm ci` where an appropriate lockfile is present. 9. Add dependency and container-image signature verification to the documented workflow. 10. Run builds and containers with non-root users and narrowly scoped filesystem and network permissions. ]]>

T08 · Insecure Dependencies

Error

• Location: references/faq.md:13
• Finding: FAQ Pulls a Mutable Latest Container Image<![CDATA[ ## Vulnerability Details **File Location**: `references/faq.md:13-21` **Vulnerability Type**: Mutable third-party container dependency **Risk Level**: High ### Vulnerable Code ```bash # Check Docker docker --version # Check port lsof -i :3000 # Manually pull image docker pull nofxai/nofx:latest ``` ### Technical Analysis The `latest` tag is mutable and does not identify a fixed, audited image. The registry owner or an attacker who compromises the image publication process can replace the image behind this tag after the Skill audit. Pulling the image does not itself start it, but the FAQ presents the command as part of the installation recovery workflow, and the deployment instructions subsequently run NOFX containers. No digest, signature, software bill of materials, or provenance verification is provided. ### Attack Path 1. An attacker compromises the container registry account or upstream image build process. 2. The attacker publishes a malicious image under `nofxai/nofx:latest`. 3. A user follows the FAQ and pulls the changed image. 4. The image is later started through the documented deployment workflow. 5. Malicious container code accesses available environment variables, mounted data, credentials, and network resources. 6. Unsafe container privileges or mounts could enable escalation to the host. ### Impact Assessment The attacker obtains the permissions assigned to the resulting container. This may include access to NOFX configuration, stored API credentials, trading data, network services, and persistent Docker volumes. Host compromise is possible if deployment grants privileged mode, dangerous capabilities, sensitive mounts, or Docker socket access. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `latest` with an immutable image digest: ```bash docker pull nofxai/nofx@sha256:<verified-digest> ``` 2. Publish signed release images and verify them with an appropriate container-signing mechanism. 3. Document the expected image version, digest, provenance, and release notes. 4. Scan each release image for known vulnerabilities and embedded secrets. 5. Run the container as a non-root user with a read-only root filesystem where practical. 6. Remove unnecessary Linux capabilities, mounts, ports, and network access. 7. Require explicit review before changing the pinned image digest. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/nofx-api.sh:29
• Finding: NOFX API Key Is Exposed in Request URLs<![CDATA[ ## Vulnerability Details **File Location**: `scripts/nofx-api.sh:29-42` **Additional Occurrences**: The same `?auth=$API_KEY` pattern continues through `scripts/nofx-api.sh:149` and is documented in `SKILL.md:52-113` and `references/webhooks.md:107-133`. **Vulnerability Type**: Sensitive credential exposure through URL query parameters **Risk Level**: Medium ### Vulnerable Code ```bash case "$endpoint" in # AI Signals ai500) curl -s "$BASE_URL/api/ai500/list?auth=$API_KEY" ;; ai500-stats) curl -s "$BASE_URL/api/ai500/stats?auth=$API_KEY" ;; ai500-coin) symbol="${1:-BTC}" curl -s "$BASE_URL/api/ai500/$symbol?auth=$API_KEY" ;; ai300) limit="${1:-10}" curl -s "$BASE_URL/api/ai300/list?auth=$API_KEY&limit=$limit" ;; ``` ### Technical Analysis The script embeds the API credential in the query string of every request. URLs are more likely than authorization headers to be recorded by access logs, reverse proxies, monitoring systems, tracing tools, debugging output, shell diagnostics, or process inspection. The Skill itself documents bearer-token authentication as an alternative, so placing the secret in the query string is not necessary. HTTPS protects the request in transit but does not prevent exposure through endpoint logs or local process metadata. ### Attack Path 1. A user configures a valid NOFX API key in `config.json` or `NOFX_API_KEY`. 2. The helper expands the key into the request URL. 3. A local process observer, monitoring agent, proxy, server log, or diagnostic system records the complete URL. 4. An attacker with access to that record extracts the `auth` parameter. 5. The attacker reuses the key against the NOFX API until the credential expires or is revoked. ### Impact Assessment An attacker can exercise whatever NOFX API permissions are associated with the exposed key. Based on the audited helper, this includes access to market signals ...[truncated 399 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove API credentials from all URL query strings. 2. Use the documented authorization header: ```bash curl --fail --silent --show-error \ -H "Authorization: Bearer $API_KEY" \ "$BASE_URL/api/ai500/list" ``` 3. Apply the same change to every endpoint and documentation example. 4. Ensure request headers are not written to debug or application logs. 5. Store `config.json` with permissions no broader than `0600`. 6. Avoid exporting the key globally when a protected secret file or secret manager can be used. 7. Rotate keys that may already have appeared in URL, proxy, or server logs. 8. Add request timeouts and failure handling while modifying the wrapper: ```bash curl --fail --silent --show-error --connect-timeout 10 --max-time 30 ... ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/webhooks.md:30
• Finding: Telegram Bot Token Is Exposed in Command-Line URL Arguments<![CDATA[ ## Vulnerability Details **File Location**: `references/webhooks.md:30-38` **Additional Occurrence**: `references/webhooks.md:105-111` **Vulnerability Type**: Sensitive token exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```bash TELEGRAM_BOT_TOKEN="your_bot_token" CHAT_ID="your_chat_id" MESSAGE="🚀 NOFX Alert: ETH breaks $2000" curl -s -X POST "https://api.telegram.org/bot$TELEGRAM_BOT_TOKEN/sendMessage" \ -d "chat_id=$CHAT_ID" \ -d "text=$MESSAGE" \ -d "parse_mode=Markdown" ``` A second example uses the same token-in-URL pattern: ```bash curl -s "https://api.telegram.org/bot$BOT_TOKEN/sendMessage" \ -d "chat_id=$CHAT_ID" \ -d "text=🚀 BTC breaks $70,000!" ``` ### Technical Analysis Telegram's Bot API requires the token in the URL path. In these shell examples, variable expansion places the complete token-bearing URL in curl's command-line arguments. Depending on the operating system and monitoring configuration, other local users, process collectors, audit systems, shell tracing, or diagnostic tools may capture those arguments. The examples also encourage placing secrets directly in shell variables without documenting file permissions, secret-manager use, token rotation, or process-exposure risks. ### Attack Path 1. A user replaces the placeholder with a valid Telegram bot token and runs the command. 2. The shell expands the token into curl's URL argument. 3. A local process observer or monitoring system captures the command line while curl is running. 4. An attacker obtains the stored process record and extracts the token. 5. The attacker invokes the Telegram Bot API as the compromised bot. ### Impact Assessment A stolen token can allow unauthorized use of the bot, including sending messages and accessing Bot API data available to that bot. This can enable alert spoofing, phishing through trusted notification channels, operational disruption, and disclosure of messages or updates available under ...[truncated 168 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not hardcode real bot tokens in scripts, command history, or documentation-derived files. 2. Store the token in a secret manager or a file restricted to mode `0600`. 3. Use a dedicated notification client or protected curl configuration that minimizes token exposure in process arguments. 4. Disable shell tracing before handling secrets: ```bash set +x ``` 5. Restrict access to process-monitoring, audit, and CI logs. 6. Redact Telegram Bot API paths from proxy and application logs. 7. Rotate the bot token immediately if it has appeared in shared logs or process captures. 8. Restrict bot permissions and validate destination chat identifiers before sending messages. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (38)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The code clearly supports part of the declared description: it integrates with NOFX endpoints for crypto market data, AI signals, fund flow tracking, OI monitoring, and related market analysis. However, the declared purpose is substantially broader than what this code chunk actually does. The script is only a command-line API fetcher for read-oriented data endpoints. It does not implement or expose functionality for strategy creation or management, trader control/management, backtesting, automated reporting, or any AI debate arena features. There is no evidence of order execution, account/trader administration, report generation, or strategy lifecycle operations. So while the description is directionally related, it materially overstates the capabilities present in this supplied code chunk.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill instructs an agent to create, save, and activate trading strategies without any safety gating, suitability warning, or explicit confirmation step. In the context of a live crypto trading platform, activating a strategy can directly lead to real-money losses, unintended orders, or autonomous trading behavior based on parsed natural-language instructions.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The trader management section allows creation and starting or stopping traders through browser automation without requiring confirmation or warning about account impact. Because these actions can start autonomous trading or interrupt existing positions and protections, an incorrect or manipulated instruction could cause immediate financial harm.

Chaining Abuse

High

• Category: Tool Misuse

Content

### 一键安装 (Linux/macOS)

```bash
curl -fsSL https://raw.githubusercontent.com/NoFxAiOS/nofx/main/install.sh | bash
```

安装完成后访问: **http://127.0.0.1:3000**

• Confidence: 99% confidence
• Finding: The pipe into bash removes the user's chance to inspect downloaded content before execution and is a well-known dangerous command-chaining pattern. If the remote content is altered, arbitrary shell commands run immediately on the host.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The server deployment section explicitly recommends HTTP with transport encryption disabled by default and does not warn about confidentiality or integrity risks. For a trading platform handling API keys, trader control, and potentially sensitive market actions, unencrypted access can expose credentials, session tokens, and administrative actions to interception or tampering.

Chaining Abuse

High

• Category: Tool Misuse

Content

默认禁用传输加密，可直接通过 IP 访问:

```bash
curl -fsSL https://raw.githubusercontent.com/NoFxAiOS/nofx/main/install.sh | bash
# 访问: http://YOUR_SERVER_IP:3000
```

• Confidence: 99% confidence
• Finding: The same dangerous curl-to-bash chaining is recommended for server deployment, where compromise is especially serious because the host may be internet-exposed and hold production credentials. Combined with the nearby advice to use HTTP, this increases operational risk for a trading system deployment.

Chaining Abuse

High

• Category: Tool Misuse

Content

每日运行以获取最新版本:

```bash
curl -fsSL https://raw.githubusercontent.com/NoFxAiOS/nofx/main/install.sh | bash
```

## 初始配置

• Confidence: 99% confidence
• Finding: Using a pipe-to-bash chain for updates creates a recurring remote-code-execution workflow, making compromise of the upstream script an efficient way to reach existing installations. This is particularly sensitive in a trading platform context where hosts may store exchange credentials and automation logic.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Re-run installation script
curl -fsSL https://raw.githubusercontent.com/NoFxAiOS/nofx/main/install.sh | bash
```

### Q: Will data be lost?

• Confidence: 99% confidence
• Finding: The pipe into 'bash' turns external content retrieval into immediate execution, removing the opportunity for user inspection and greatly increasing exploitation likelihood. Given this skill supports crypto trading operations, a malicious or compromised script could steal credentials, modify bots, redirect trades, or fully compromise the trading server.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill includes shell usage examples and operational instructions but does not declare an explicit tool scope such as allowed tools or permissions. That creates an authorization ambiguity where an agent may use shell capabilities more broadly than intended, increasing the chance of unintended command execution or unsafe handling of credentials and trading operations.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill tells users to store API and account-related credentials in a workspace file without any secret-handling guidance. Workspace files are commonly readable by tools, agents, logs, backups, or source control, so this pattern increases the likelihood of credential leakage that could expose market data access, browser identity, or potentially linked trading operations.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide gives direct instructions to start or stop live traders via browser automation without any warning to verify user intent, confirm account/environment, or require a human approval step. In a crypto trading context, these are consequential actions that can immediately alter live market exposure, so omission of safeguards materially increases the chance of accidental or unauthorized trading changes.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The import/export workflow describes moving strategy JSON without warning about sensitive data exposure, provenance validation, or overwrite risks. In this skill's context, exported strategies may contain proprietary logic or risky configuration, and imported JSON could unintentionally replace settings or introduce unsafe trading behavior if used without review.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The documentation instructs users to fetch a remote shell script and pipe it directly into bash, which executes unreviewed network content immediately. If the upstream repository, CDN path, or transport chain is compromised, users could run arbitrary code with their local privileges without an opportunity to inspect the script first.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# 下载并启动
curl -O https://raw.githubusercontent.com/NoFxAiOS/nofx/main/docker-compose.prod.yml
docker compose -f docker-compose.prod.yml up -d

# 管理命令

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide tells users to download a remote Docker Compose file and immediately start it, which causes arbitrary container images, ports, volumes, and environment settings from network-fetched content to be trusted by default. A malicious or compromised compose file could start unsafe services, expose secrets, mount sensitive host paths, or run attacker-controlled images.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The Windows instructions repeat the same unsafe pattern of downloading a remote compose file and launching it without review. This can lead users to run untrusted containers and host mappings on their systems with little visibility into what is being started.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

brew install ta-lib

# Ubuntu/Debian
sudo apt-get install libta-lib0-dev
```

### 安装步骤

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The update instructions again tell users to execute a remotely hosted script directly in bash, compounding supply-chain risk because this action is encouraged as a recurring maintenance workflow. Repeated unattended execution increases the blast radius of any compromise of the script source or delivery path.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document gives step-by-step instructions for creating live trading API keys with trading permissions across multiple exchanges, but it does not clearly warn that these keys can immediately authorize real-money trades and losses if misused, misconfigured, or supplied to an untrusted integration. In a crypto trading skill, this omission is more dangerous because users are likely to follow the steps directly and connect production accounts, increasing the chance of financial loss from operator error, compromised systems, or unsafe downstream tooling.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The FAQ recommends pulling a Docker image using the floating 'latest' tag, which is mutable and can change over time without notice. This weakens supply-chain integrity because users cannot verify they are getting the expected build, and a compromised or accidentally replaced image could be deployed.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The FAQ instructs users to download and immediately execute a remote shell script via 'curl ... | bash' without any integrity verification, review step, or warning. If the GitHub source, transport path, or referenced branch is tampered with, arbitrary code would run on the user's system with the user's privileges.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This document provides detailed leveraged grid-trading configuration examples, expected return calculations, and strategy recommendations without any explicit warning that users can lose all invested capital, that leverage amplifies losses, or that the content is not personalized financial advice. In a trading skill context, omission of these warnings can encourage unsafe real-money use by inexperienced users and materially increases the chance of harmful decision-making.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: Lines L098-L100 instruct the user to create sub-accounts and transfer funds, which can affect user assets and may be difficult to reverse if done incorrectly. The document provides procedural steps but no warning to confirm account identity, amounts, or exchange-side implications before moving funds.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The configuration schema sets `"language": "zh"` as a fixed value in the example, which indicates a locale/language constraint without any user opt-in or explanation. This matches the policy concern for forcing a specific language unless the skill offers choice or documents a justified regional scope.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The second strategy example again hard-codes `"language": "zh"`, reinforcing a forced locale behavior rather than presenting language as user-selectable. Because no opt-in, alternatives, or regional justification are provided in the surrounding text, this is a natural-language policy violation.

Static analysis

No suspicious patterns detected.