T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:75
- Finding
- Real-Money Trading Is the Unsafe Default## Vulnerability Details **File Location**: `SKILL.md`, lines 75-79 **Vulnerability Type**: Unsafe default for consequential financial operations **Risk Level**: High **Vulnerable Code Snippet**: ```markdown ## Key Notes - Instrument IDs are numeric (not tickers). Resolve via `/market-data/search?internalSymbolFull=AAPL` - Trading tools default to `mode=real`. Only use demo if explicitly requested. - All trading execution is logged with full request details before sending. - Rate limit: 100 req/min ``` ### Technical Analysis The Skill explicitly instructs the Agent to default trading operations to real mode and to use demo mode only when the user requests it. This is an unsafe default because the documented trading endpoints can open and close positions or cancel orders using an authenticated eToro account. The instructions do not require an explicit opt-in to real trading, a transaction preview, a second confirmation, exposure limits, or validation that the user knowingly selected a live account. Consequently, an ambiguous request, misunderstood intent, or incorrect parameter could cause the Agent to send a consequential request to a real trading endpoint. This is classified as `T09: Insecure Skill Coding Practices` because the Skill configuration establishes an unsafe operational default for irreversible or financially significant actions. ### Attack Path 1. The Skill is loaded with credentials authorized to execute trades on an eToro account. 2. A user asks the Agent to open or close a position without explicitly specifying real or demo mode. 3. The Agent follows the instruction in `SKILL.md` and selects `mode=real`. 4. No mandatory live-trading confirmation or transaction preview is required by the Skill. 5. The Agent submits the authenticated request to a real trading execution endpoint. 6. The account incurs a real position, order modification, cancellation, financial exposure, fees, or loss. An attacke ...[truncated 881 chars]
- Remediation
- ## Remediation Suggestions 1. Change the default account mode to `demo`; reject trading requests whose mode is unspecified rather than silently selecting a live account. 2. Require an explicit, transaction-specific opt-in such as `mode=real` before constructing any live trading request. 3. Present a confirmation summary before every real transaction, including: - Account mode and account identifier - Instrument and resolved numeric instrument ID - Buy or sell direction - Amount or unit quantity - Order type and price constraints - Leverage and estimated maximum exposure - Stop-loss and take-profit settings - Estimated fees or other material consequences 4. Require affirmative confirmation after presenting the summary. Do not infer confirmation from an earlier or unrelated message. 5. Apply configurable limits for order value, leverage, aggregate exposure, and trading frequency. Reject transactions outside those limits or require stronger approval. 6. Validate instrument IDs, position IDs, order IDs, quantities, and account mode immediately before submission. 7. Make cancellation and position-closing actions subject to the same confirmation requirements as position opening. 8. Ensure execution logs redact authorization headers, API keys, user keys, tokens, and sensitive account information.