Monte Carlo Crypto Core

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:39 AM UTC
• Version: 1.3.0

Overview

This skill does run crypto simulations, but it also automatically contacts an external paid billing service using user IDs and a bundled API key, which needs careful review before installation.

Review this as a paid networked skill, not a purely local simulator. Before installing, require the publisher to remove the embedded API key, fix the environment variable mismatch, document exactly what user data is sent to SkillPay, and make charging an explicit user-approved action rather than the default simulation path.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/billing.py:17
• Finding: Hard-Coded Billing API Credential## Vulnerability Details **File Location**: `scripts/billing.py:17` **Vulnerability Type**: Hard-coded secret in source code **Risk Level**: High ```python API_KEY = os.environ.get("SKILL_BILLING_API_KEY", "sk_91dc212149c7ee3184de119159a89a3a432455bfbfb1d87cf3f3db4b8764ab0c") ``` ### Technical Analysis The billing module contains a live-looking API key as the default value when `SKILL_BILLING_API_KEY` is absent. Anyone who can download or inspect the skill package can recover this credential. Although the source comments describe the key as charge-only, its actual server-side permissions cannot be verified from the repository. The documentation compounds the issue by directing users to configure `SKILLPAY_API_KEY`, while the implementation reads `SKILL_BILLING_API_KEY`. Consequently, a user who follows the documented setup will not override the embedded credential, and billing calls will silently use the exposed fallback. ### Attack Path 1. An attacker downloads or otherwise obtains the publicly distributed skill package. 2. The attacker inspects `scripts/billing.py` and extracts the fallback API key. 3. The attacker submits requests to the documented SkillPay billing endpoints using the recovered key in the `X-API-Key` header. 4. The requests execute with whatever permissions SkillPay assigned to that credential, potentially allowing unauthorized billing operations, publisher impersonation, or quota consumption. 5. Because legitimate installations also default to the same credential, abuse may be difficult to distinguish from expected skill traffic. ### Impact Assessment The exposed credential can be reused outside the skill without local privilege escalation. The affected scope includes the associated SkillPay publisher or skill billing identity and any operations authorized to this API key. Potential consequences include unauthorized charge requests, service or quota abuse, attribution of attacker traffic to the publi ...[truncated 224 chars]
• Remediation: ## Remediation Suggestions 1. Immediately revoke and rotate the exposed API key through the SkillPay provider. 2. Remove the hard-coded fallback and require the credential to be supplied securely: ```python API_KEY = os.environ.get("SKILL_BILLING_API_KEY") if not API_KEY: raise RuntimeError("SKILL_BILLING_API_KEY is required") ``` 3. Correct `SKILL.md` and `README.md` so that they consistently document `SKILL_BILLING_API_KEY`. 4. Prefer keeping publisher credentials on a controlled backend. The distributed skill should call that backend using a narrowly scoped user or installation token rather than shipping a publisher credential. 5. Restrict the replacement key to only the required endpoint and skill identifier, with rate limits, expiration, rotation, and audit logging. 6. Review provider logs for unauthorized use of the exposed key and invalidate any related sessions or derived credentials. 7. Add secret scanning to CI and release checks to prevent credentials from entering future packages.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19
• Finding: Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md:19-20` and `README.md:13-15` **Vulnerability Type**: Mutable and unverified dependency resolution **Risk Level**: Medium `SKILL.md` contains: ```markdown ## Setup 1. Install `requests`: `pip install requests` 2. Set the `SKILLPAY_API_KEY` environment variable with the skill owner's SkillPay API key. ``` `README.md` contains: ```markdown ## Prerequisites - Python 3.9+ - `requests` library (for billing): `pip install requests` - `SKILLPAY_API_KEY` environment variable (set by the skill owner) ``` ### Technical Analysis The installation instructions resolve `requests` and its transitive dependencies without a pinned version, lockfile, or cryptographic hashes. The resulting package set depends on the configured package index and the versions available at installation time, meaning that reviewed source code does not fully determine the runtime environment. This pattern does not itself demonstrate that the legitimate `requests` package is malicious. It nevertheless creates a supply-chain exposure: a compromised package index, maliciously configured mirror, compromised future dependency release, or unexpected incompatible release could supply code different from the version originally tested. Python packages may execute code during installation and are imported at runtime by `scripts/billing.py`, so a compromised resolved artifact could gain code execution in the installing user's context. ### Attack Path 1. A user follows the documented `pip install requests` instruction. 2. Pip queries the user's configured index or mirror and dynamically selects the current package and dependency versions. 3. An attacker who controls or compromises that index, mirror, package release, or a transitive dependency provides a malicious artifact. 4. Pip downloads and installs the artifact without verification against project-maintained hashes. 5. Malicious code executes du ...[truncated 785 chars]
• Remediation: ## Remediation Suggestions 1. Define dependencies in a reviewed requirements or lock file using exact versions. 2. Generate and verify cryptographic hashes, for example: ```text requests==REVIEWED_VERSION --hash=sha256:REVIEWED_ARTIFACT_HASH ``` 3. Install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Pin all transitive dependencies or use a lockfile generated by a dependency-management tool. 5. Explicitly use a trusted package index and avoid untrusted global pip mirror configuration. 6. Install into an isolated virtual environment under a non-privileged account rather than using system-wide or administrator-level pip. 7. Add automated dependency vulnerability scanning and a controlled review process for version updates. 8. Keep installation documentation synchronized with the locked dependency workflow.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tainted flow: 'HEADERS' from os.environ.get (line 19, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

def charge_user(user_id: str) -> dict:
    """Charge 1 token (= 0.001 USDT) per call."""
    try:
        resp = requests.post(f"{BILLING_URL}/charge", headers=HEADERS, json={
            "user_id": user_id, "skill_id": SKILL_ID, "amount": 0,
        }, timeout=10)
        data = resp.json()

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'HEADERS' from os.environ.get (line 19, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

def get_balance(user_id: str) -> float:
    resp = requests.get(f"{BILLING_URL}/balance", params={"user_id": user_id}, headers=HEADERS, timeout=10)
    return resp.json()["balance"]

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'HEADERS' from os.environ.get (line 19, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

def get_payment_link(user_id: str, amount: float = 8) -> str:
    resp = requests.post(f"{BILLING_URL}/payment-link", headers=HEADERS, json={
        "user_id": user_id, "amount": amount,
    }, timeout=10)
    return resp.json()["payment_url"]

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill requires a user identifier and invokes external charging behavior despite presenting itself primarily as a local simulation tool and declaring no effective permissions. That inconsistency is dangerous because users or orchestration systems may pass identifiers into a skill they do not realize can trigger payment actions or communicate with third-party services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill requires a user identifier and invokes external charging behavior despite presenting itself primarily as a local simulation tool and declaring no effective permissions. That inconsistency is dangerous because users or orchestration systems may pass identifiers into a skill they do not realize can trigger payment actions or communicate with third-party services.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file implements a payment and charging client even though the skill is described as a Monte Carlo crypto trading simulator. That mismatch is a strong indicator of hidden or unrelated functionality, which is especially dangerous in agent skills because it can monetize or transmit user data outside the expected purpose and evade user scrutiny.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can charge users, query balances, and generate payment links, none of which are justified by a trading-simulation core. Embedding external payment-processing capability in an unrelated skill creates risk of unauthorized charges, privacy leakage of user identifiers, and deceptive monetization behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises executable behavior requiring environment variables and networked billing, but it does not declare any explicit tool scope or allowed permissions. This weakens security review and policy enforcement because callers may invoke a seemingly analytical trading skill that can also access secrets and make outbound requests.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: This markdown file describes what the skill can do, but it does not define clear trigger phrases, scope boundaries, or negative examples for when the skill should or should not activate. Broad wording like "This skill enables you to run sophisticated Monte Carlo simulations for trading strategies" could overlap with many general crypto or analysis requests and lead to unintended invocation.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation instructs transmission of user identifiers into a billing/payment workflow without any explicit warning about privacy, retention, sharing, or third-party processing. In a finance-adjacent skill, this is more sensitive because user IDs may be linkable to accounts, charges, and behavioral data, making undisclosed handling a meaningful privacy risk.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The docstring claims each call charges 1 token, but the request payload sends amount: 0. This inconsistency can conceal actual billing behavior, cause incorrect assumptions during review, and enable deceptive or broken charging logic that operators and users cannot accurately reason about.

External Transmission

Medium

• Category: Data Exfiltration

Content

def charge_user(user_id: str) -> dict:
    """Charge 1 token (= 0.001 USDT) per call."""
    try:
        resp = requests.post(f"{BILLING_URL}/charge", headers=HEADERS, json={
            "user_id": user_id, "skill_id": SKILL_ID, "amount": 0,
        }, timeout=10)
        data = resp.json()

• Confidence: 80% confidence
• Finding: This request sends a user identifier and skill identifier to an external billing endpoint and can trigger a billing action. External transmission alone is not always a vulnerability, but in this skill context it is risky because the functionality is unrelated to the stated Monte Carlo purpose and may cause undisclosed charging or data sharing.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: These functions transmit user identifiers to an external billing service and can participate in charging/payment flows without any evident user-facing disclosure or consent mechanism in this module. In the context of a trading-simulation skill, silent transmission and monetization are more dangerous because users would not reasonably expect billing side effects from analytics functionality.

External Transmission

Medium

• Category: Data Exfiltration

Content

def get_payment_link(user_id: str, amount: float = 8) -> str:
    resp = requests.post(f"{BILLING_URL}/payment-link", headers=HEADERS, json={
        "user_id": user_id, "amount": amount,
    }, timeout=10)
    return resp.json()["payment_url"]

• Confidence: 80% confidence
• Finding: The payment-link request transmits a user identifier externally and facilitates monetization through a third-party service. In a skill presented as a trading simulator, this creates an unjustified privacy and financial-risk surface because users and operators may not expect any payment workflow at all.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The file presents itself as a pure mathematical Monte Carlo core, but the executable path includes an external billing action unless the caller knows to opt out. This mismatch is dangerous because operators may run the script expecting offline computation while it triggers account-charging or networked payment behavior, violating least surprise and potentially enabling unauthorized charges in automation contexts.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The script enforces billing before running the advertised Monte Carlo simulation, which is functionality outside the stated purpose of the skill. In agent or automated toolchains, this can cause unexpected charging or outbound requests simply by invoking a computational utility, creating financial and operational risk.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Charging a user account is not necessary for performing a local Monte Carlo price simulation, so embedding that capability in the tool expands privileges and side effects beyond what users would reasonably expect. This increases the danger of abuse or accidental invocation, especially when the skill may be run by higher-level agents on behalf of users.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The billing action is triggered by default with only a terse --skip-billing escape hatch, which is insufficient notice for a side effect involving account charging and possible network communication. Hidden or poorly disclosed side effects are especially risky in CLI tools because users and orchestrating agents may assume the command is safe to run repeatedly as a local analysis step.

Natural-Language Policy Violations

Low

• Confidence: 71% confidence
• Finding: The module description fixes billing terms to `USDT` and token pricing as a universal default, with no indication that users can opt into another currency or locale. This can be a natural-language policy issue when skills impose a specific billing locale or currency format without user choice or documented regional justification.

Static analysis

No suspicious patterns detected.