Nautilus Trader

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:17 AM UTC
• Version: 1.0.0

Overview

The skill is coherent documentation for NautilusTrader, but it can steer an agent into broad setup, remote shell installers, sudo package changes, and real trading workflows without enough explicit user control.

Install only if you want an agent to help with NautilusTrader setup and trading workflows. Before allowing commands, review any network download, avoid curl-to-shell installers where possible, keep installation inside a disposable virtual environment or container, do not run sudo automatically, and use testnet or paper credentials until you intentionally approve live trading with limited-permission API keys.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:56

Finding

Mutable remote installer scripts are piped directly into a shell

Content

View full analysis

Remediation

View remediation

' /tmp/rustup-init.sh | sha256sum --check less /tmp/rustup-init.sh sh /tmp/rustup-init.sh -y ``` The expected digest must come from a separately authenticated, version-specific source and must not be downloaded from the same mutable endpoint without signature validation. 3. **Prefer trusted package managers or prebuilt packages.** For users who only need NautilusTrader, recommend installation into an isolated virtual environment with a pinned package version. Do not require a Rust compiler unless a source build is actually requested. 4. **Check before installing.** Test whether `rustc`, `clang`, and `uv` already exist. Installation must be conditional and separately authorized. 5. **Require explicit user confirmation for system changes.** Never automatically execute `sudo apt-get`. Present the required package and rationale, then ask the user to approve the system-wide modification. 6. **Pin all relevant versions.** Pin NautilusTrader, uv, Rust toolchain, and source repository revisions to reviewed versions or commit hashes. Use lockfiles and hash-verified dependency resolution where supported. 7. **Separate usage from development setup.** Make the minimal PyPI installation the default path. Place source compilation and toolchain installation in an explicitly selected development section. 8. **Apply least privilege.** Run installation and builds in a disposable virtual environment or container without production exchange credentials. Do not expose ...[truncated 289 chars]

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

The explicit shell pipeline into sh is a chaining pattern that converts remote content retrieval directly into command execution. In a skill context, this is more dangerous because the agent may present or run it as part of a routine setup flow, bypassing the normal caution a user might apply to arbitrary shell pipelines.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

4b. Install uv (if not already available)

bash

curl -LsSf https://astral.sh/uv/install.sh | sh

4c. Install nautilus_trader

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill activation criteria are broad enough to trigger on generic trading, backtesting, or exchange-related mentions, which can cause the agent to invoke this skill without clear user intent. In a skill that includes environment-changing setup steps and live-trading guidance, overbroad routing increases the chance of unnecessary code, shell, or operational instructions being surfaced inappropriately.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to run repository checks, clone code, install toolchains, create virtual environments, and modify the local system without first requiring explicit user consent or warning that the environment will be changed. This is dangerous because an automatically invoked skill could cause unintended system modification, package installation, or network access in response to a normal informational request.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The skill includes a sudo apt-get install -y clang command, which elevates privileges and changes system packages. In agent-driven workflows, privileged package installation is risky because it expands the blast radius of mistakes, can alter unrelated workloads on the host, and may be executed without the user's informed approval.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

Linux (Ubuntu)

curl https://sh.rustup.rs -sSf | sh -s -- -y source $HOME/.cargo/env sudo apt-get install -y clang

text

Verify: `rustc --version` and `clang --version`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guide provides a minimal strategy template that can place market orders and close positions, and it explicitly states the same code runs in backtest, sandbox, and live modes. In a skill intended to help users build trading strategies, omission of a prominent warning about live-trading consequences increases the risk that generated or copied code will be run against real accounts, causing unintended financial loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

These examples show direct order submission plus bulk cancellation and position-closing operations without adjacent cautionary language. Because NautilusTrader supports live trading, documentation that normalizes these calls without guardrails can lead an agent or user to generate operationally destructive actions on live brokerage or exchange accounts.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The skill fetches and executes a remote installer script for Rust using curl ... | sh, which trusts network-delivered code at execution time without integrity verification. If the remote host, connection, or script content is compromised, this becomes arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

bash

# macOS (Rust + clang are typically available, just ensure Rust is installed)
curl https://sh.rustup.rs -sSf | sh -s -- -y
source $HOME/.cargo/env

# Linux (Ubuntu)

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

This is a second occurrence of the same remote-script execution pattern for Rust installation on Linux. Repeating curl ... | sh in setup guidance normalizes unsafe execution of unauthenticated external code and increases the likelihood of arbitrary code execution if followed automatically or blindly.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

source $HOME/.cargo/env

Linux (Ubuntu)

curl https://sh.rustup.rs -sSf | sh -s -- -y source $HOME/.cargo/env sudo apt-get install -y clang

text

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The uv installer is fetched from an external URL and piped directly to sh, creating the same arbitrary code execution risk as other pipe-to-shell patterns. Because this appears in prerequisite setup, it is especially likely to be run early and with little scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

4b. Install uv (if not already available)

bash

curl -LsSf https://astral.sh/uv/install.sh | sh

4c. Install nautilus_trader

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The guide instructs users to generate a tearsheet with output_path="tearsheet.html", which creates a file on disk, but it does not explicitly warn that running the example will write output to the local filesystem. Under the markdown-file criteria, behaviors affecting user data or system state should be disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The example calls fig.write_html("bars_with_fills.html"), which writes a new HTML artifact to disk, but the surrounding documentation does not warn about this filesystem modification. For markdown guidance, file-creating behavior should be disclosed when it may affect user files.

Content

No source excerpt is available for this finding.