Security audit

enforceBackendUse

Security checks for vulnerabilities and agentic risk

Overview

This instruction-only skill is not malicious, but it should be reviewed because it routes real financial trade requests to an unreviewed backend without built-in confirmation safeguards and asks to send more data than needed.

Install only if you trust the separate `process_request` backend and have verified it shows the exact asset, side, amount, account, fees, and order type before any transaction; requires explicit user confirmation; rejects ambiguous requests; enforces sensible limits; and does not log or forward unnecessary user text or internal reasoning.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

High

Confidence: 94% confidence
Finding: The skill enables real financial execution but does not include a clear user-facing warning that actions may place actual trades and modify assets or money. In a financial context, this omission is especially dangerous because users may misunderstand analysis versus execution and trigger unintended transactions with real monetary consequences.

Ssd 3

High

Confidence: 99% confidence
Finding: The schema requires sending both full user_input and agent_reasoning to the tool, which can leak sensitive financial instructions, personal data, and internal chain-of-thought or hidden deliberations. Exposing internal reasoning is unnecessary for execution and increases the risk of privacy breaches, prompt leakage, and misuse if the tool logs, stores, or forwards this data.

Static analysis

No suspicious patterns detected.