mt5_trade

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:53 PM UTC
• Version: 1.0.0

Overview

This skill is for user-confirmed MT5 trading, but its order confirmation command handles draft JSON unsafely and could run unintended PowerShell commands if crafted data is submitted.

Review carefully before installing. Only use it with a trusted local MT5 API, understand that it can submit real broker orders, and do not proceed unless the confirm command is changed to pass JSON as data through stdin, a temporary file, or another safely escaped mechanism rather than pasting JSON into PowerShell source.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:101

Finding

PowerShell Command Injection Through Unsafe Draft JSON Interpolation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 101
Vulnerability Type: PowerShell command injection
Risk Level: High

Vulnerable Code:

powershell

powershell -NoProfile -Command "$body = '<PASTE_DRAFT_JSON_HERE>'; irm -Method Post -Uri http://127.0.0.1:8000/order_confirm -ContentType 'application/json' -Body $body | ConvertTo-Json -Depth 50"

Technical Analysis

The skill instructs the agent to paste the draft JSON directly into a single-quoted PowerShell string. The draft is derived from the local API response and may also incorporate user-supplied risk constraints. Because the JSON is embedded in executable PowerShell source without context-aware escaping, an apostrophe in a JSON value can terminate the string literal. Additional text can then be interpreted as PowerShell commands.

Binding the API to 127.0.0.1 does not eliminate this risk. A malicious or compromised local service, or another process able to spoof the expected API, could return a crafted draft. The required user confirmation reduces automatic execution risk but does not neutralize the injection: the payload is executed when a user confirms an apparently valid displayed order.

Attack Path

1. An attacker compromises, replaces, or impersonates the service listening on 127.0.0.1:8000, or otherwise influences the draft data.
2. The /order_draft endpoint returns syntactically plausible JSON containing an apostrophe followed by malicious PowerShell syntax in a field value.
3. The agent displays the draft and asks the user for the required exact confirmation.
4. The user replies CONFIRM ORDER, believing that only the displayed order will be submitted.
5. The agent substitutes the crafted JSON into the line 101 command.
6. The apostrophe terminates the intended string, and PowerShell interprets the injected content as commands.
7. Those commands execute with the privileges of the process running the agent.

Impa

...[truncated 485 chars]

Remediation

View remediation

Remediation Suggestions

• Do not interpolate API responses or user-controlled data into PowerShell program text.
• Pass the JSON as data through a securely created temporary file, standard input, or a separately bound process argument.
• If transport through command text is unavoidable, encode the exact UTF-8 JSON outside the PowerShell source, pass only a strictly validated Base64 value, and decode it as data inside PowerShell.
• Parse and validate the draft against a strict schema. Reject unknown properties, unexpected data types, invalid symbols, and values outside permitted ranges.
• Canonically serialize the validated object immediately before submission rather than copying displayed text into a command.
• Cryptographically bind confirmation to the exact reviewed draft, such as by displaying and retaining a digest or server-issued single-use identifier, and verify that the submitted payload exactly matches it.
• Authenticate the local API and verify that the expected service owns the endpoint; do not treat localhost alone as a trust boundary.
• Run the agent and trading client with the minimum filesystem, credential, process, and network permissions required.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep