Open-broker

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:51 AM UTC
• Version: 1.2.0

Overview

OpenBroker appears to be a legitimate trading skill, but it gives agents live financial trading authority with persistent custom automations that require careful review.

Install only if you intentionally want agent-assisted live crypto trading. Use a dedicated low-balance or restricted API wallet, test with testnet and --dry first, inspect any generated TypeScript strategy before running it live, keep a clear stop procedure, and configure webhooks or dashboard URLs only to endpoints you control.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly instructs the agent to write custom TypeScript files to disk and execute them as automations. That materially expands capability from invoking a trading CLI into authoring and persisting arbitrary code, which creates a powerful code-execution and persistence primitive that could be abused for unauthorized actions, secret access, or long-lived autonomous behavior.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill describes webhook-based alerts and agent wake-ups, including bearer-token protected delivery and configurable channels, but does not clearly warn that account events, position data, PnL, and automation messages may be transmitted to external services. In a financial/trading context, silent outbound transmission of sensitive operational data increases privacy and security risk, especially if channels or mappings are misconfigured.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `ob_cancel` | `openbroker cancel --all` or `--coin <COIN>` |
| `ob_outcome_buy` | `openbroker outcome-buy --outcome <ID> --outcome-side yes --size <SIZE>` |
| `ob_outcome_sell` | `openbroker outcome-sell --outcome <ID> --outcome-side yes --size <SIZE>` |
| `ob_auto_run` | `openbroker auto run <script> [--dry]` |
| `ob_auto_stop` | `openbroker auto stop <id>` (or SIGINT if run in foreground) |
| `ob_auto_list` | `openbroker auto list` |

• Confidence: 84% confidence
• Finding: Exposing `ob_auto_run`/`openbroker auto run` enables the agent to start long-running trading automations, which can continue making decisions and taking actions beyond a single user-approved command. In a financial plugin with access to a private key, this substantially raises the risk of unbounded autonomous trading, loss amplification, and persistence of unintended behavior.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. Read the relevant bundled example source code to understand the automation API patterns
2. Write a **custom automation** tailored to the user's specific requirements (coin, size, thresholds, risk parameters, TP/SL logic, etc.)
3. Save it to `~/.openbroker/automations/` and run it with `openbroker auto run`

Do NOT simply run `openbroker auto run --example dca --set coin=HYPE`. The examples use generic defaults and lack the nuanced risk management, position sizing, and TP/SL logic that a real strategy needs. Always write a purpose-built automation.

• Confidence: 90% confidence
• Finding: The skill directs the agent to write a custom strategy to disk and then run it, combining autonomous decision-making with arbitrary persistent code execution. In context, this is more dangerous than ordinary trading commands because it allows indefinite, user-tailored logic to place trades, react to events, and survive beyond the immediate interaction.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

openbroker auto run my-strategy --dry       # Test without trading
openbroker auto run ./funding-scalp.ts      # Run from path
openbroker auto run my-strategy --poll 5000 # Poll every 5s
openbroker auto run my-strategy --no-ws     # Disable WebSocket, pure REST polling
openbroker auto run --example dca --set coin=HYPE --set amount=50 --dry  # Run bundled example
openbroker auto examples                    # List bundled examples with config
openbroker auto list                        # Show available scripts

• Confidence: 83% confidence
• Finding: The documented `auto run` capability allows strategies to be launched from local files with configurable polling and live execution. Because the skill is a trading plugin with account credentials, this autonomy can directly control funds and continue operating without per-action confirmation.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Trading Automations

Automations let you write custom event-driven trading logic as TypeScript scripts. Write exactly the logic you need and OpenBroker handles the polling, event detection, and SDK access.

### IMPORTANT: Bundled Examples Are References, Not Ready-Made Strategies

• Confidence: 88% confidence
• Finding: The automation feature is explicitly persistent: the agent can write strategy files and rely on stored state across restarts. Persistence makes mistakes or abuse more dangerous because autonomous behavior can survive the initiating session and continue to trade or monitor indefinitely.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.