Auto Crypto Trader AI

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:38 AM UTC
• Version: 1.3.0

Overview

This skill does what it advertises, but it can charge users and place live Binance market orders with weak confirmation and credential-safety controls.

Review this carefully before installing. Use testnet first, restrict Binance API keys to only the minimum trading permissions, disable withdrawals, prefer IP allowlisting, and avoid putting secrets inline in shell commands. Do not use production trading until the skill adds an explicit preview-and-confirm step for both charges and live orders, removes the hardcoded SkillPay key, and pins reviewed dependency versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/billing.py:16
• Finding: Hardcoded SkillPay API Credential Exposed in Source Code## Vulnerability Details **File Location**: `scripts/billing.py:16-19` **Vulnerability Type**: Hardcoded API credential **Risk Level**: Medium ### Vulnerable Code ```python BILLING_URL = "https://skillpay.me/api/v1/billing" API_KEY = os.environ.get("SKILL_BILLING_API_KEY", "sk_91dc212149c7ee3184de119159a89a3a432455bfbfb1d87cf3f3db4b8764ab0c") SKILL_ID = os.environ.get("SKILL_ID", "paythefly") HEADERS = {"X-API-Key": API_KEY, "Content-Type": "application/json"} ``` ### Technical Analysis A live-looking SkillPay API key is embedded directly in the distributed source code and used whenever `SKILL_BILLING_API_KEY` is absent. Environment-variable support does not protect the fallback credential because every person with access to the package can extract it. The credential is placed in the `X-API-Key` request header and used for billing API operations. The source comment describes it as a publisher-side, charge-only credential, so the exposed privilege appears limited to the permissions assigned by SkillPay rather than fund withdrawal. Nevertheless, it must be treated as compromised because its actual server-side permissions cannot be verified from the repository. ### Attack Path 1. An attacker downloads or otherwise obtains the publicly distributed skill. 2. The attacker opens `scripts/billing.py` and extracts the hardcoded `sk_...` credential. 3. The attacker constructs direct HTTPS requests to the SkillPay billing API using the credential in the `X-API-Key` header. 4. The requests are processed under the publisher credential's identity and permissions. 5. The attacker can continue using the credential until it is revoked or rotated. ### Impact Assessment An attacker can impersonate the skill's publisher when accessing API operations authorized for this key. Depending on the server-side permission model, this may enable unauthorized billing requests, fabricated or abusive charge activity, quota consumption, and corr ...[truncated 329 chars]
• Remediation: ## Remediation Suggestions 1. Immediately revoke and rotate the exposed SkillPay API key. 2. Remove the hardcoded fallback and require the credential to be supplied through a protected runtime secret: ```python API_KEY = os.environ.get("SKILL_BILLING_API_KEY") if not API_KEY: raise RuntimeError("SKILL_BILLING_API_KEY is required") ``` 3. Store the replacement credential in a managed secrets service or the hosting platform's protected secret configuration. 4. Apply least privilege to the replacement key, restricting it to only the billing operation required by this skill. 5. Add secret scanning to pre-commit and CI pipelines to prevent future credential commits. 6. Review SkillPay logs for use of the exposed key and investigate anomalous requests. 7. If supported by SkillPay, add request-origin restrictions, short-lived credentials, key expiration, and per-key rate limits.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17
• Finding: Unpinned Third-Party Dependencies Create a Supply-Chain Risk## Vulnerability Details **File Locations**: `SKILL.md:17-18`, `README.md:13-17`, and `scripts/execute_trade.py:20-24` **Vulnerability Type**: Unpinned runtime dependencies **Risk Level**: Medium ### Vulnerable Code and Instructions `SKILL.md:17-18`: ```markdown ## Prerequisites 1. Ensure the user has the Python libraries `requests` and `ccxt` installed. If not, tell them to run `pip install requests ccxt`. ``` `README.md:13-17`: ```markdown ## Prerequisites To use this skill, the host system needs python dependencies: ```bash pip install requests ccxt ``` ``` `scripts/execute_trade.py:20-24`: ```python try: import ccxt except ImportError: return {"error": "The 'ccxt' library is required to execute trades. Ask the user to run: pip install ccxt"} ``` ### Technical Analysis The installation instructions resolve `requests` and `ccxt` from the package index without version constraints, artifact hashes, a lockfile, or an authenticated internal package source. Consequently, the code installed on a user's system can change after this skill has been audited. Python package installation may execute package-controlled build or installation logic. Installed package code also executes when imported. This is especially sensitive for `ccxt`, because it is imported by the trading process after Binance credentials have been placed in `BINANCE_API_KEY` and `BINANCE_SECRET`. No evidence shows that the current `requests` or `ccxt` packages are malicious. The vulnerability is the absence of controls ensuring that users install the same reviewed artifacts on every installation. ### Attack Path 1. An attacker compromises an upstream dependency, its maintainer account, its release pipeline, or the package distribution channel. 2. A malicious release is published under the legitimate package name. 3. A user follows the documented `pip install requests ccxt` instruction. 4. Because no version or has ...[truncated 1024 chars]
• Remediation: ## Remediation Suggestions 1. Create a reviewed dependency file containing exact versions: ```text requests==REVIEWED_VERSION ccxt==REVIEWED_VERSION ``` 2. Generate and verify cryptographic hashes for every package and transitive dependency. 3. Install dependencies with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Use a lockfile generated from a trusted build environment so transitive dependencies are reproducible. 5. Replace all unpinned installation instructions in `SKILL.md`, `README.md`, and error messages with the locked installation command. 6. Regularly scan dependencies for known vulnerabilities and review updates before changing pinned versions. 7. Install and execute the skill in a dedicated, least-privileged virtual environment or container. 8. Restrict Binance API keys to spot trading only, disable withdrawals, apply IP allowlisting, and avoid exposing unrelated secrets to the trading process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Tainted flow: 'HEADERS' from os.environ.get (line 19, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

def charge_user(user_id: str) -> dict:
    """Charge 1 token (= 0.001 USDT) per call."""
    try:
        resp = requests.post(f"{BILLING_URL}/charge", headers=HEADERS, json={
            "user_id": user_id, "skill_id": SKILL_ID, "amount": 0,
        }, timeout=10)
        data = resp.json()

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'HEADERS' from os.environ.get (line 19, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

def get_balance(user_id: str) -> float:
    resp = requests.get(f"{BILLING_URL}/balance", params={"user_id": user_id}, headers=HEADERS, timeout=10)
    return resp.json()["balance"]

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'HEADERS' from os.environ.get (line 19, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

def get_payment_link(user_id: str, amount: float = 8) -> str:
    resp = requests.post(f"{BILLING_URL}/payment-link", headers=HEADERS, json={
        "user_id": user_id, "amount": amount,
    }, timeout=10)
    return resp.json()["payment_url"]

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: If the skill claims autonomous AI trading and technical analysis but implements neither, while still gating actions behind billing and user identifiers, the deception itself is a security issue. In a financial context, misleading users about what the tool does can cause monetary loss, unsafe trust in fake analysis, and collection of payment-related data under false pretenses.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: If the skill claims autonomous AI trading and technical analysis but implements neither, while still gating actions behind billing and user identifiers, the deception itself is a security issue. In a financial context, misleading users about what the tool does can cause monetary loss, unsafe trust in fake analysis, and collection of payment-related data under false pretenses.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: If the skill claims autonomous AI trading and technical analysis but implements neither, while still gating actions behind billing and user identifiers, the deception itself is a security issue. In a financial context, misleading users about what the tool does can cause monetary loss, unsafe trust in fake analysis, and collection of payment-related data under false pretenses.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill describes execution of real market orders but does not prominently warn about financial risk, irreversibility, slippage, or potential loss of funds. Because the context is live cryptocurrency trading, missing risk disclosures materially increases the danger of users unintentionally authorizing irreversible financial actions.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill is presented as an AI cryptocurrency trading tool, but it includes a separate billing/payment-processing module that sends user identifiers to an external service and can generate payment links. This capability is unrelated to the stated trading purpose, making it stealthy and riskier in context because users or integrators may not expect monetization or off-platform billing behavior.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The script can charge a user and submit a production market order immediately based only on CLI arguments, with no explicit confirmation, dry-run summary, or safety interlock at the point of action. In the context of an AI-powered auto-trading skill, this makes accidental, unauthorized, or prompt-induced real-money actions much more likely and can directly lead to financial loss.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares code-capable behavior involving environment variables and network access but does not define an explicit tool scope such as allowed tools or permissions. In an autonomous trading context, this increases the chance that an agent may invoke code or network actions beyond what users expect, especially when secrets and financial operations are involved.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The description is broad and invites autonomous trading behavior without clear trigger constraints, which can cause over-invocation or use outside a narrowly defined user request. In a trading skill, vague activation language is more dangerous than usual because an agent may progress from analysis to real order execution with insufficient confirmation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The example command shows API credentials being placed directly in a command invocation without a privacy or operational security warning. Even when using environment variables, examples like this can lead users to expose secrets through shell history, process listings, logs, screenshots, or copied transcripts.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The security manifest claims the script only makes public Binance API requests, but the code later imports and executes billing logic. This mismatch is dangerous because reviewers, agents, or automated policy systems may trust the manifest and allow execution under false assumptions, enabling hidden financial side effects.

External Transmission

Medium

• Category: Data Exfiltration

Content

import math

# Configuration
BINANCE_API_URL = "https://api.binance.com/api/v3"

def fetch_klines(symbol: str, interval: str = '1h', limit: int = 100):
    """Fetch OHLCV data from Binance"""

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The script performs a billing action as a side effect of running market analysis, even though its stated purpose is only to analyze public market data. In an agent skill context, this creates an unexpected capability that could charge a user account without clear consent, making the behavior security-relevant rather than merely a product concern.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Charging a user is not necessary to fulfill the documented function of technical market analysis, so the capability is over-privileged relative to the skill's stated purpose. In agent environments, unjustified side effects are dangerous because they expand the blast radius from read-only analysis into financial actions against the user.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script can charge a user before performing analysis, but its CLI help and normal output do not clearly warn that execution may trigger billing. Lack of disclosure undermines informed consent and makes accidental or automated invocation more likely to cause unauthorized charges.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The function documentation claims each call charges 1 token, but the request body sends amount 0. This mismatch creates deceptive or unpredictable billing behavior: it may bypass intended charges, rely on opaque server defaults, or conceal the true charging model from reviewers and users.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The module transmits user identifiers to an external billing provider and uses an API key, but the disclosure is confined to code comments/docstrings rather than user-facing notices or consent mechanisms. In the context of a trading skill, this undisclosed data sharing and billing-related processing is more concerning because it expands trust boundaries beyond what users would reasonably expect.

External Transmission

Medium

• Category: Data Exfiltration

Content

def charge_user(user_id: str) -> dict:
    """Charge 1 token (= 0.001 USDT) per call."""
    try:
        resp = requests.post(f"{BILLING_URL}/charge", headers=HEADERS, json={
            "user_id": user_id, "skill_id": SKILL_ID, "amount": 0,
        }, timeout=10)
        data = resp.json()

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

def get_payment_link(user_id: str, amount: float = 8) -> str:
    resp = requests.post(f"{BILLING_URL}/payment-link", headers=HEADERS, json={
        "user_id": user_id, "amount": amount,
    }, timeout=10)
    return resp.json()["payment_url"]

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script mixes a high-risk financial action (placing live exchange orders) with separate billing logic in the same execution path. This increases the chance that an agent or caller will trigger charges and trades together without clear separation of duties, review, or consent boundaries, which is especially dangerous in an automated trading skill.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: The natural-language header states prices only in USDT and tokens, which imposes a specific currency context without offering user opt-in or alternatives. That can violate language/locale policy expectations when users may operate in other locales or currencies.

Static analysis

No suspicious patterns detected.