Monte Carlo Crypto Core

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:39 AM UTC
• Version: 1.3.0

Overview

This skill does run crypto simulations, but it also automatically contacts an external paid billing service using user IDs and a bundled API key, which needs careful review before installation.

Review this as a paid networked skill, not a purely local simulator. Before installing, require the publisher to remove the embedded API key, fix the environment variable mismatch, document exactly what user data is sent to SkillPay, and make charging an explicit user-approved action rather than the default simulation path.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/billing.py:17

Finding

Hard-Coded Billing API Credential

Content

View full analysis

Vulnerability Details

File Location: scripts/billing.py:17
Vulnerability Type: Hard-coded secret in source code
Risk Level: High

python

API_KEY = os.environ.get("SKILL_BILLING_API_KEY", "sk_91dc212149c7ee3184de119159a89a3a432455bfbfb1d87cf3f3db4b8764ab0c")

Technical Analysis

The billing module contains a live-looking API key as the default value when SKILL_BILLING_API_KEY is absent. Anyone who can download or inspect the skill package can recover this credential. Although the source comments describe the key as charge-only, its actual server-side permissions cannot be verified from the repository.

The documentation compounds the issue by directing users to configure SKILLPAY_API_KEY, while the implementation reads SKILL_BILLING_API_KEY. Consequently, a user who follows the documented setup will not override the embedded credential, and billing calls will silently use the exposed fallback.

Attack Path

1. An attacker downloads or otherwise obtains the publicly distributed skill package.
2. The attacker inspects scripts/billing.py and extracts the fallback API key.
3. The attacker submits requests to the documented SkillPay billing endpoints using the recovered key in the X-API-Key header.
4. The requests execute with whatever permissions SkillPay assigned to that credential, potentially allowing unauthorized billing operations, publisher impersonation, or quota consumption.
5. Because legitimate installations also default to the same credential, abuse may be difficult to distinguish from expected skill traffic.

Impact Assessment

The exposed credential can be reused outside the skill without local privilege escalation. The affected scope includes the associated SkillPay publisher or skill billing identity and any operations authorized to this API key. Potential consequences include unauthorized charge requests, service or quota abuse, attribution of attacker traffic to the publi ...[truncated 224 chars]

Remediation

View remediation

Remediation Suggestions

1. Immediately revoke and rotate the exposed API key through the SkillPay provider.
2. Remove the hard-coded fallback and require the credential to be supplied securely:

   python

   API_KEY = os.environ.get("SKILL_BILLING_API_KEY")
   if not API_KEY:
       raise RuntimeError("SKILL_BILLING_API_KEY is required")
   

3. Correct SKILL.md and README.md so that they consistently document SKILL_BILLING_API_KEY.
4. Prefer keeping publisher credentials on a controlled backend. The distributed skill should call that backend using a narrowly scoped user or installation token rather than shipping a publisher credential.
5. Restrict the replacement key to only the required endpoint and skill identifier, with rate limits, expiration, rotation, and audit logging.
6. Review provider logs for unauthorized use of the exposed key and invalidate any related sessions or derived credentials.
7. Add secret scanning to CI and release checks to prevent credentials from entering future packages.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:19-20 and README.md:13-15
Vulnerability Type: Mutable and unverified dependency resolution
Risk Level: Medium

SKILL.md contains:

markdown

## Setup
1. Install `requests`: `pip install requests`
2. Set the `SKILLPAY_API_KEY` environment variable with the skill owner's SkillPay API key.

README.md contains:

markdown

## Prerequisites

- Python 3.9+
- `requests` library (for billing): `pip install requests`
- `SKILLPAY_API_KEY` environment variable (set by the skill owner)

Technical Analysis

The installation instructions resolve requests and its transitive dependencies without a pinned version, lockfile, or cryptographic hashes. The resulting package set depends on the configured package index and the versions available at installation time, meaning that reviewed source code does not fully determine the runtime environment.

This pattern does not itself demonstrate that the legitimate requests package is malicious. It nevertheless creates a supply-chain exposure: a compromised package index, maliciously configured mirror, compromised future dependency release, or unexpected incompatible release could supply code different from the version originally tested.

Python packages may execute code during installation and are imported at runtime by scripts/billing.py, so a compromised resolved artifact could gain code execution in the installing user's context.

Attack Path

1. A user follows the documented pip install requests instruction.
2. Pip queries the user's configured index or mirror and dynamically selects the current package and dependency versions.
3. An attacker who controls or compromises that index, mirror, package release, or a transitive dependency provides a malicious artifact.
4. Pip downloads and installs the artifact without verification against project-maintained hashes.
5. Malicious code executes du ...[truncated 785 chars]

Remediation

View remediation

Remediation Suggestions

1. Define dependencies in a reviewed requirements or lock file using exact versions.
2. Generate and verify cryptographic hashes, for example:

   text

   requests==REVIEWED_VERSION --hash=sha256:REVIEWED_ARTIFACT_HASH
   

3. Install with hash enforcement:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Pin all transitive dependencies or use a lockfile generated by a dependency-management tool.
5. Explicitly use a trusted package index and avoid untrusted global pip mirror configuration.
6. Install into an isolated virtual environment under a non-privileged account rather than using system-wide or administrator-level pip.
7. Add automated dependency vulnerability scanning and a controlled review process for version updates.
8. Keep installation documentation synchronized with the locked dependency workflow.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tainted flow: 'HEADERS' from os.environ.get (line 19, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/billing.py (reported line 25)May include surrounding context.

python

def charge_user(user_id: str) -> dict:
    """Charge 1 token (= 0.001 USDT) per call."""
    try:
        resp = requests.post(f"{BILLING_URL}/charge", headers=HEADERS, json={
            "user_id": user_id, "skill_id": SKILL_ID, "amount": 0,
        }, timeout=10)
        data = resp.json()

Tainted flow: 'HEADERS' from os.environ.get (line 19, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/billing.py (reported line 37)May include surrounding context.

python

def get_balance(user_id: str) -> float:
    resp = requests.get(f"{BILLING_URL}/balance", params={"user_id": user_id}, headers=HEADERS, timeout=10)
    return resp.json()["balance"]

Tainted flow: 'HEADERS' from os.environ.get (line 19, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/billing.py (reported line 42)May include surrounding context.

python

def get_payment_link(user_id: str, amount: float = 8) -> str:
    resp = requests.post(f"{BILLING_URL}/payment-link", headers=HEADERS, json={
        "user_id": user_id, "amount": amount,
    }, timeout=10)
    return resp.json()["payment_url"]

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill requires a user identifier and invokes external charging behavior despite presenting itself primarily as a local simulation tool and declaring no effective permissions. That inconsistency is dangerous because users or orchestration systems may pass identifiers into a skill they do not realize can trigger payment actions or communicate with third-party services.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill requires a user identifier and invokes external charging behavior despite presenting itself primarily as a local simulation tool and declaring no effective permissions. That inconsistency is dangerous because users or orchestration systems may pass identifiers into a skill they do not realize can trigger payment actions or communicate with third-party services.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file implements a payment and charging client even though the skill is described as a Monte Carlo crypto trading simulator. That mismatch is a strong indicator of hidden or unrelated functionality, which is especially dangerous in agent skills because it can monetize or transmit user data outside the expected purpose and evade user scrutiny.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code can charge users, query balances, and generate payment links, none of which are justified by a trading-simulation core. Embedding external payment-processing capability in an unrelated skill creates risk of unauthorized charges, privacy leakage of user identifiers, and deceptive monetization behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises executable behavior requiring environment variables and networked billing, but it does not declare any explicit tool scope or allowed permissions. This weakens security review and policy enforcement because callers may invoke a seemingly analytical trading skill that can also access secrets and make outbound requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file describes what the skill can do, but it does not define clear trigger phrases, scope boundaries, or negative examples for when the skill should or should not activate. Broad wording like "This skill enables you to run sophisticated Monte Carlo simulations for trading strategies" could overlap with many general crypto or analysis requests and lead to unintended invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation instructs transmission of user identifiers into a billing/payment workflow without any explicit warning about privacy, retention, sharing, or third-party processing. In a finance-adjacent skill, this is more sensitive because user IDs may be linkable to accounts, charges, and behavioral data, making undisclosed handling a meaningful privacy risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring claims each call charges 1 token, but the request payload sends amount: 0. This inconsistency can conceal actual billing behavior, cause incorrect assumptions during review, and enable deceptive or broken charging logic that operators and users cannot accurately reason about.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

This request sends a user identifier and skill identifier to an external billing endpoint and can trigger a billing action. External transmission alone is not always a vulnerability, but in this skill context it is risky because the functionality is unrelated to the stated Monte Carlo purpose and may cause undisclosed charging or data sharing.

Content

Scanner excerpt · scripts/billing.py (reported line 25)May include surrounding context.

python

def charge_user(user_id: str) -> dict:
    """Charge 1 token (= 0.001 USDT) per call."""
    try:
        resp = requests.post(f"{BILLING_URL}/charge", headers=HEADERS, json={
            "user_id": user_id, "skill_id": SKILL_ID, "amount": 0,
        }, timeout=10)
        data = resp.json()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

These functions transmit user identifiers to an external billing service and can participate in charging/payment flows without any evident user-facing disclosure or consent mechanism in this module. In the context of a trading-simulation skill, silent transmission and monetization are more dangerous because users would not reasonably expect billing side effects from analytics functionality.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The payment-link request transmits a user identifier externally and facilitates monetization through a third-party service. In a skill presented as a trading simulator, this creates an unjustified privacy and financial-risk surface because users and operators may not expect any payment workflow at all.

Content

Scanner excerpt · scripts/billing.py (reported line 42)May include surrounding context.

python

def get_payment_link(user_id: str, amount: float = 8) -> str:
    resp = requests.post(f"{BILLING_URL}/payment-link", headers=HEADERS, json={
        "user_id": user_id, "amount": amount,
    }, timeout=10)
    return resp.json()["payment_url"]

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file presents itself as a pure mathematical Monte Carlo core, but the executable path includes an external billing action unless the caller knows to opt out. This mismatch is dangerous because operators may run the script expecting offline computation while it triggers account-charging or networked payment behavior, violating least surprise and potentially enabling unauthorized charges in automation contexts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script enforces billing before running the advertised Monte Carlo simulation, which is functionality outside the stated purpose of the skill. In agent or automated toolchains, this can cause unexpected charging or outbound requests simply by invoking a computational utility, creating financial and operational risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Charging a user account is not necessary for performing a local Monte Carlo price simulation, so embedding that capability in the tool expands privileges and side effects beyond what users would reasonably expect. This increases the danger of abuse or accidental invocation, especially when the skill may be run by higher-level agents on behalf of users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The billing action is triggered by default with only a terse --skip-billing escape hatch, which is insufficient notice for a side effect involving account charging and possible network communication. Hidden or poorly disclosed side effects are especially risky in CLI tools because users and orchestrating agents may assume the command is safe to run repeatedly as a local analysis step.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The module description fixes billing terms to USDT and token pricing as a universal default, with no indication that users can opt into another currency or locale. This can be a natural-language policy issue when skills impose a specific billing locale or currency format without user choice or documented regional justification.

Content

No source excerpt is available for this finding.