T08 · Insecure Dependencies
Error
- Location
SKILL.md:6- Finding
Unpinned and Inconsistently Named npm Dependency Handles Wallet Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Open-broker
Security checks for vulnerabilities and agentic risk
Overview
This skill is for real-money trading and is mostly transparent, but it defaults agents toward live, persistent financial automation with broad wallet authority.
Install only if you are comfortable giving this tool trading authority over a dedicated, limited wallet. Prefer testnet or --dry first, use a restricted API wallet where possible, cap funding and leverage, review generated automation code before any live run, avoid broad mainnet permissions, verify the exact npm package/version, and set OB_DASHBOARD_URL only to a trusted endpoint.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:1181- Finding
Financial Automations Are Directed to Execute Live by Default
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:675- Finding
Configurable Dashboard Endpoint Receives Sensitive Trading Telemetry Without Documented Transport Controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (16)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 91% confidence
- Finding
The skill exposes an
ob_auto_runcapability that can start autonomous trading automations from within the agent environment. Because these automations can place orders continuously and react to market events, this materially increases the risk of unsupervised financial actions if triggered without strict approval and guardrails.- Content
md | `ob_cancel` | `openbroker cancel --all` or `--coin <COIN>` | | `ob_outcome_buy` | `openbroker outcome-buy --outcome <ID> --outcome-side yes --size <SIZE>` | | `ob_outcome_sell` | `openbroker outcome-sell --outcome <ID> --outcome-side yes --size <SIZE>` | | `ob_auto_run` | `openbroker auto run <script> [--dry]` | | `ob_auto_stop` | `openbroker auto stop <id>` (or SIGINT if run in foreground) | | `ob_auto_list` | `openbroker auto list` |
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 89% confidence
- Finding
The setup flow recommends an agent-ready wallet with builder fee auto-approved and no browser approval, making the environment immediately capable of live trading once funded. This removes friction and safety pauses that might otherwise prevent accidental or unauthorized trades.
- Content
text The `setup` command offers three modes: 1. **Generate fresh wallet** (recommended for agents) — creates a dedicated trading wallet with builder fee auto-approved. No browser steps needed — just fund with USDC and start trading. 2. **Import existing key** — use a private key you already have 3. **Generate API wallet** — creates a restricted wallet that can trade but cannot withdraw. Requires browser approval from a master wallet.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
This section states the agent is ready to trade immediately after funding, reinforcing a default posture of autonomous live execution. In a conversational agent setting, such immediacy is dangerous because a mistaken instruction or prompt injection could quickly translate into financial loss.
- Content
md ### Fresh Wallet Setup (Recommended for Agents) The simplest setup for agents. A fresh wallet is generated, the builder fee is auto-approved, and the agent is ready to trade immediately after funding. **Flow:** 1. Run `openbroker setup` and choose option 1 ("Generate a fresh wallet")
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
The skill enables persistent custom TypeScript trading automations, which materially expands the blast radius from one-shot commands to long-lived autonomous behavior. Persistence makes accidental, malicious, or buggy logic more dangerous because it can continue acting after the initiating session ends.
- Content
md ## Trading Automations Automations let you write custom event-driven trading logic as TypeScript scripts. Write exactly the logic you need and OpenBroker handles the polling, event detection, and SDK access. ### IMPORTANT: Bundled Examples Are References, Not Ready-Made Strategies
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 93% confidence
- Finding
The skill directly instructs the agent to write custom trading automation and then run it, enabling the model to generate executable strategy code that can autonomously trade. This is dangerous because generated logic may be flawed, over-broad, or manipulated by prompts, leading to repeated real-money actions without per-trade user review.
- Content
md 1. Read the relevant bundled example source code to understand the automation API patterns 2. Write a **custom automation** tailored to the user's specific requirements (coin, size, thresholds, risk parameters, TP/SL logic, etc.) 3. Save it to `~/.openbroker/automations/` and run it with `openbroker auto run` Do NOT simply run `openbroker auto run --example dca --set coin=HYPE`. The examples use generic defaults and lack the nuanced risk management, position sizing, and TP/SL logic that a real strategy needs. Always write a purpose-built automation.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
Although framed as safer than using bundled examples, this line still encourages purpose-built autonomous strategy generation and execution. Tailored automations can be even more capable and risky because they may incorporate user- or prompt-driven logic that places trades automatically over time.
- Content
- Write a custom automation tailored to the user's specific requirements (coin, size, thresholds, risk parameters, TP/SL logic, etc.)
- Save it to
~/.openbroker/automations/and run it withopenbroker auto run
Do NOT simply run
openbroker auto run --example dca --set coin=HYPE. The examples use generic defaults and lack the nuanced risk management, position sizing, and TP/SL logic that a real strategy needs. Always write a purpose-built automation.To view bundled examples and their config schemas:
bash
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 87% confidence
- Finding
The runtime automatically records detailed audit data and can forward notes, metrics, and trade actions to a dashboard URL in real time. This creates persistence and potential exfiltration of sensitive financial activity, account telemetry, and strategy behavior to local or remote services, especially if
OB_DASHBOARD_URLis attacker-controlled or misconfigured.- Content
md | `api.id` | Automation ID (filename or `--id` flag) | | `api.dryRun` | `true` if running with `--dry` (write methods are intercepted) | Automations now write a local audit trail automatically to `~/.openbroker/automation-audit.sqlite`. The runtime records run config, logs, state changes, write actions, order updates, fills, user events, and per-poll account snapshots so you can generate performance reports later. **Dashboard Forwarding:** When `OB_DASHBOARD_URL` is set (e.g. `http://localhost:3001`), audit notes, metrics, and trade actions are automatically forwarded to the OpenBroker Vaults dashboard API in real time. The vault address is read from `HYPERSTABLE_VAULT_ADDRESS` or `VAULT`. Forwarding is fire-and-forget — it never blocks the automation or causes errors if the dashboard is unreachable.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
To disable WebSocket (pure REST polling):
bash openbroker auto run my-strategy.ts --no-wsChoosing the Right Event — Quick Guide
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
To disable WebSocket (pure REST polling):
bash openbroker auto run my-strategy.ts --no-wsChoosing the Right Event — Quick Guide
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
To disable WebSocket (pure REST polling):
bash openbroker auto run my-strategy.ts --no-wsChoosing the Right Event — Quick Guide
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
To disable WebSocket (pure REST polling):
bash openbroker auto run my-strategy.ts --no-wsChoosing the Right Event — Quick Guide
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
To disable WebSocket (pure REST polling):
bash openbroker auto run my-strategy.ts --no-wsChoosing the Right Event — Quick Guide
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 94% confidence
- Finding
The CLI examples prominently show how to start automations, including live runs, which normalizes autonomous trading execution as a routine action. In combination with account credentials and order APIs, this lowers friction for launching unattended strategies that can place real trades.
- Content
CLI:
bash openbroker auto run my-strategy --dry # Test without trading openbroker auto run ./funding-scalp.ts # Run from path openbroker auto run my-strategy --poll 5000 # Poll every 5s openbroker auto run my-strategy --no-ws # Disable WebSocket, pure REST polling
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md | `--set key=value` | Set config values (repeatable) | - | **Inspecting automations after they run:** - `openbroker auto report <id>` — reads the local SQLite audit trail at `~/.openbroker/automation-audit.sqlite` and prints a summary of logs, write actions, fills, PnL, and custom metrics recorded via `api.audit.record()` / `api.audit.metric()`. Use this to review what a strategy actually did. - `openbroker auto clean` — prunes registry entries for automations that are no longer running or whose script file is gone. Safe to run anytime. **Guidelines for agents writing automations:**
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs agents not to use dry-run unless the user asks, while exposing live order-placement and automation capabilities tied to a real private key. In an agent context, this creates a strong risk of unintended real-money trades without a clear mandatory confirmation gate immediately before execution.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md **Communication:** - Use `api.publish()` to send alerts/events back to the OpenClaw agent — do NOT manually construct webhook requests. - Publish on: position opened/closed, TP/SL triggered, PnL threshold exceeded, margin warning, automation errors, and any automated trade execution. The user should always know what the automation did and why. - Include actionable context in publish messages — coin, price, size, PnL, and what happened — so the user can make informed decisions without checking the terminal. **General:** - Scripts are loaded from `~/.openbroker/automations/` by name, or from any absolute path.
Static analysis
No suspicious patterns detected.