Security audit

Toobit Trading

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Toobit trading helper, but it can place orders, cancel orders, change futures settings, and withdraw funds if the user confirms those actions.

Install only if you intend to let an agent operate your Toobit account. Use API keys with the minimum permissions needed, avoid withdrawal permission unless required, and carefully review every confirmation prompt for orders, cancellations, leverage, transfers, and withdrawals before approving.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tool Parameter Abuse

High

Category: Tool Misuse
Content: #### Cancel Order ``` DELETE /api/v1/spot/order ``` **WRITE: Confirm before executing**
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: #### Cancel All Open Orders ``` DELETE /api/v1/spot/openOrders ``` **WRITE: Confirm before executing**
Confidence: 84% confidence
Finding: The skill exposes a cancel-all-open-orders operation and marks the symbol filter as optional, allowing a single confirmed action to wipe all open spot orders across the account. In a natural-language agent context, broad destructive operations are especially risky because ambiguous user phrasing or misparsed parameters can cause account-wide trading disruption.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: #### Cancel Orders by IDs ``` DELETE /api/v1/spot/cancelOrderByIds ``` **WRITE: Confirm before executing**
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: #### Close Listen Key ``` DELETE /api/v1/userDataStream ``` | Param | Required | Description | |-------|----------|-------------|
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: #### Cancel Futures Order ``` DELETE /api/v1/futures/order ``` **WRITE: Confirm before executing**
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: #### Batch Cancel Futures Orders ``` DELETE /api/v1/futures/batchOrders ``` **WRITE: Confirm before executing**
Confidence: 86% confidence
Finding: The batch cancel futures endpoint can cancel broad sets of orders and only requires a symbol, with side optional, making it easy to over-cancel if the agent misinterprets intent. In an automated NL-to-API workflow, broad destructive APIs without strong scoping and preview safeguards create a real risk of unintended trading loss or strategy disruption.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: #### Cancel Futures Orders by IDs ``` DELETE /api/v1/futures/cancelOrderByIds ``` **WRITE: Confirm before executing**
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: #### Close Listen Key ``` DELETE /api/v1/listenKey ``` | Param | Required | Description | |-------|----------|-------------|
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill description says to use the skill when the user mentions Toobit, or when they want to trade/query crypto on Toobit, but in practice this can over-match generic crypto requests and route users into a high-privilege trading skill. In a skill that can place orders, transfer funds, and withdraw assets, overly broad triggering increases the chance of accidental invocation and unintended execution of sensitive actions.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: The usage examples are exclusively written as Chinese user utterances, which implies a fixed language expectation in the skill's natural-language interface. The file does not state that the skill is region-specific or that users may choose another language, so this can violate language/locale neutrality expectations.

Static analysis

No suspicious patterns detected.