webull-openapi

• Outcome: Review
• Latest audit: Aug 19, 2026 · 6:52 AM UTC
• Version: 1.1.9

Overview

The skill is a coherent Webull trading integration, but it needs Review because it can affect real brokerage accounts and saved watchlists without a code-enforced confirmation gate.

Install only if you intentionally want an AI-driven CLI to access your Webull account. Keep WEBULL_ENVIRONMENT=uat until you are ready for live trading, require a separate human confirmation before every order or watchlist deletion/removal, protect the .env, token directory, and audit logs, and verify regional endpoint behavior before using ZA or production accounts.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill describes capabilities that require access to environment variables, local files, and outbound network connections, but the skill metadata does not declare any permissions. In a trading skill, these capabilities are especially sensitive because they expose API credentials in .env files, token storage locations, and live brokerage access without explicit permission scoping or user visibility.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The ZA region documentation is mislabeled and points to Australian production and UAT endpoints instead of South Africa-specific hosts. In a trading skill, incorrect regional endpoint guidance can cause clients or integrators to route authentication, account, or order traffic to the wrong jurisdiction, creating operational failures, compliance issues, and possible unintended data disclosure to the wrong environment.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The file is presented as a market-data module, but it also exposes state-changing watchlist actions such as create, update, delete, and instrument add/remove. That scope expansion is dangerous because an agent or user expecting read-only market data could unknowingly perform account modifications, increasing the chance of unintended changes to saved user data.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The legacy validate_order() function advertises support for stock, crypto, and futures orders, but it always routes requests through validate_stock_order(), which enforces stock-oriented rules only. In a trading skill, this mismatch can cause unsupported asset classes to be accepted under the wrong validation model or rejected inconsistently, weakening guardrails and creating a path for malformed or policy-bypassing orders when callers rely on the documented behavior.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The README includes natural-language prompts and examples that directly trigger sensitive trading actions such as placing and canceling orders without an immediate warning adjacent to those examples. In an agent-skill context, example prompts are especially risky because users or orchestration layers may copy them verbatim, causing an assistant to initiate high-impact financial actions with real accounts if safeguards are weak or production is enabled.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The quick-start section shows a concrete `place` command with a full order payload but does not warn at the point of use that the same command may execute a live trade when `WEBULL_ENVIRONMENT=prod` is configured. Because this is a copy-paste-ready CLI command in a financial trading skill, accidental execution risk is materially higher than in ordinary software documentation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This documentation advertises live trading capabilities such as previewing, placing, replacing, and cancelling orders, but it does not include any warning that these actions can have real financial consequences. In an AI-agent skill context, that omission increases the chance that an agent or user treats these endpoints as routine data operations and triggers unintended live trades or account changes.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This documentation explicitly advertises account management and live trading capabilities, including order placement, modification, cancellation, and balance/position access, but does not include any warning or safe-use guidance about real financial consequences. In an agent skill context, that omission increases the chance that an LLM-driven workflow could treat high-impact brokerage actions as routine API calls and perform them without clear user confirmation or risk acknowledgement.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This documentation explicitly presents trading capabilities such as account access, order placement, modification, and cancellation without any adjacent warning that these actions can cause irreversible real-world financial consequences. In an agent skill context, that omission can encourage unsafe automation or user confusion, increasing the chance that an LLM-driven agent performs live trades without adequate confirmation or risk disclosure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The API reference enumerates live account and order-management endpoints including preview, place, replace, and cancel order operations, but provides no visible safety warning distinguishing live trading from non-destructive queries. In an AI-consumable reference, this increases the risk that an agent treats destructive financial operations as ordinary API calls and triggers unauthorized or unintended account-impacting actions.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The referenced trading documentation lists account, stock trading, and 'place your first trade' resources without any nearby warning that actions may affect real funds, positions, or financial risk. In a skill that enables trading and account management, this omission can lead users or downstream agents to treat high-impact operations as routine API calls, increasing the chance of unintended orders or unsafe automation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation includes destructive operations like watchlist-delete and modifying operations like watchlist-instruments-remove without any warning that they alter persistent user data. In an agent setting, omission of such warnings can lead to silent deletion or modification of user watchlists if the model treats these commands as routine data queries.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This skill exposes direct order placement, modification, and cancellation capabilities for live financial instruments, but the documentation does not prominently warn that these actions can trigger real-money trades with immediate and potentially irreversible consequences. In a trading skill, omission of explicit safety gating materially increases the chance that an agent or user will treat examples and commands as low-risk operational actions rather than financially sensitive transactions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The audit logger records `client_order_id` and `account_id` in plaintext for order events, and always emits them to stderr with optional file persistence. These identifiers are sensitive financial metadata that can enable account correlation, trading activity profiling, and operational misuse if logs are exposed to other services, operators, or compromised log collectors.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This CLI exposes destructive trading actions such as place, replace, cancel, and batch-place without any explicit confirmation, dry-run gate, or interactive acknowledgment in the entrypoint. In a trading skill, that materially increases the chance of accidental or automated execution of real financial transactions, especially when invoked by higher-level agents or scripts.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This function performs a live crypto trade by directly calling the SDK order placement API, but it does not enforce an explicit confirmation or high-friction acknowledgement at the point of execution. In an agent skill context, that increases the risk of unintended or prompt-induced trades, especially because the tool is designed to accept user-provided order parameters and execute them immediately.

Credential Access

High

• Category: Privilege Escalation

Content

.env lookup order (when env_file is not provided):
    1. $WEBULL_CONFIG_DIR/.env  (if WEBULL_CONFIG_DIR is set)
    2. <project_root>/.env      (default)
    3. Current working directory .env (last resort)
    """
    if env_file is not None:
        load_dotenv(env_file, override=False)

• Confidence: 78% confidence
• Finding: Allowing an arbitrary env_file path to be loaded can be dangerous if untrusted input can reach this parameter, because an attacker could inject configuration values such as API credentials, region, environment, audit log path, or token storage path. In a trading skill, configuration poisoning is more sensitive than usual because it can redirect the skill to attacker-chosen settings and weaken operational controls even without direct code execution.

Credential Access

High

• Category: Privilege Escalation

Content

load_dotenv(env_file, override=False)
    else:
        config_dir = _resolve_config_dir()
        env_path = config_dir / ".env"
        if env_path.exists():
            load_dotenv(str(env_path), override=False)
        else:

• Confidence: 84% confidence
• Finding: Constructing and loading .env from a configurable directory and, if absent, falling back to python-dotenv default discovery can cause the process to ingest secrets or settings from unintended locations. In this trading context, accidental or attacker-influenced .env discovery is more dangerous because it can silently alter credentials, environment selection, token directories, or risk-control parameters that govern financial operations.

Known Vulnerable Dependency: pyyaml — 8 advisory(ies): CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more

Critical

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: PyYAML has a long history of unsafe deserialization issues when untrusted YAML is parsed with unsafe loaders, and the manifest permits any version >=6.0 without demonstrating a safer constrained pin or compensating controls. In a trading/account-management skill, YAML-driven configuration is plausible, so parsing attacker-influenced config could lead to code execution or logic manipulation with access to financial operations.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: The unbounded requests>=2.28 spec can resolve to versions affected by multiple security issues, including credential leakage and TLS/session handling flaws, and this skill likely performs network requests to broker APIs or related services. In a finance-oriented integration, any HTTP client weakness can expose tokens, account data, or request integrity, increasing operational risk.

Static analysis

No suspicious patterns detected.