Aster Spot

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:26 AM UTC
• Version: 0.1.1

Overview

This skill is for Aster Spot API use, but it asks agents to persist exchange API keys in a plaintext workspace file while also documenting trading, transfer, and withdrawal actions.

Review before installing. Use this only with narrowly scoped Aster API keys, preferably read-only or trading-only without withdrawal permissions, and do not place real API keys or secrets in TOOLS.md or any project Markdown file. Prefer a dedicated secret store, IP allowlisting, and explicit confirmation for every order, transfer, withdrawal, or API-key creation action.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:176
• Finding: Plaintext Collection and Persistent Storage of Aster API Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 176–249 **Vulnerability Type**: Plaintext sensitive-data handling and insecure credential persistence **Risk Level**: High ### Vulnerable Code ```markdown ### Share Credentials Users can provide Aster API credentials by sending a file where the content is in the following format: ```bash abc123...xyz secret123...key ``` ### Never Display Full Secrets When showing credentials to users: - **API Key:** Show first 5 + last 4 characters: `bb3b2...02ae` - **Secret Key:** Always mask, show only last 5: `***...ae1c` Example response when asked for credentials: Account: main API Key: bb3b2...02ae Secret: ***...ae1c Environment: Mainnet ### Listing Accounts When listing accounts, show names and environment only — never keys: Aster Accounts: * main (Mainnet) * trading (Mainnet) ### Transactions in Mainnet When performing transactions in mainnet, always confirm with the user before proceeding by asking them to write "CONFIRM" to proceed. --- ## Aster Accounts ### main - API Key: your_mainnet_api_key - Secret: your_mainnet_secret - Testnet: false ### TOOLS.md Structure ```bash ## Aster Accounts ### main - API Key: abc123...xyz - Secret: secret123...key - Testnet: false - Description: Primary trading account ### trading - API Key: trade456...abc - Secret: tradesecret...xyz - Testnet: false - Description: Secondary trading account ``` ## Agent Behavior 1. Credentials requested: Mask secrets (show last 5 chars only) 2. Listing accounts: Show names and environment, never keys 3. Account selection: Ask if ambiguous, default to main 4. When doing a transaction in mainnet, confirm with user before by asking to write "CONFIRM" to proceed 5. New credentials: Prompt for name, environment, signing mode ## Adding New Accounts When user provides new credentials: * Ask for account name * Ask: Mainnet? * Store in `TOOLS.md` with masked display confirmation ``` ### Technical Analysis The Skill ...[truncated 2257 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove instructions to place complete API credentials in `TOOLS.md` or any other project Markdown file. 2. Use an operating-system keychain, managed secret store, or similarly protected credential facility. Store only a non-sensitive account name or secret reference in `TOOLS.md`. 3. Request credentials through a dedicated secret-input mechanism rather than ordinary chat messages or plaintext file uploads. 4. Load credentials only when an authenticated request is performed and avoid retaining them longer than necessary. 5. Ensure credentials are excluded from source control, logs, transcripts, backups, generated reports, and diagnostic output. 6. Add repository ignore rules and automated secret scanning as defense-in-depth measures, while recognizing that ignore rules do not secure an already stored plaintext secret. 7. Recommend separate, narrowly scoped keys for read-only and trading operations. 8. Disable withdrawals and transfers by default, apply an IP allowlist, and enable only permissions needed for the requested operation. 9. Rotate any credential previously stored using the documented `TOOLS.md` format and securely remove residual copies from repository history, backups, and Agent workspaces. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/authentication.md:67
• Finding: API Secret Exposed Through OpenSSL Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `references/authentication.md`, lines 67–86 **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```bash #!/bin/bash API_KEY="your_api_key" SECRET_KEY="your_secret_key" BASE_URL="https://sapi.asterdex.com" # Get current timestamp TIMESTAMP=$(date +%s000) # Build query string (without signature) QUERY="symbol=BTCUSDT&side=BUY&type=MARKET&quantity=0.001&timestamp=${TIMESTAMP}" # Generate signature SIGNATURE=$(echo -n "$QUERY" | openssl dgst -sha256 -hmac "$SECRET_KEY" | cut -d' ' -f2) # Make request curl -X POST "${BASE_URL}/sapi/v1/order?${QUERY}&signature=${SIGNATURE}" \ -H "X-MBX-APIKEY: ${API_KEY}" ``` ### Technical Analysis The example passes `SECRET_KEY` to OpenSSL through the `-hmac` command-line argument. Expanded command-line arguments may be observable through process inspection, execution telemetry, audit facilities, debugging tools, or shell tracing. A local observer with access to those sources could recover the unmasked signing secret while the command is running or from retained logs. Locally calculating an HMAC and transmitting the API key and resulting signature to the declared HTTPS API host are necessary parts of the Skill’s authenticated functionality. The defect is specifically the avoidable placement of the raw secret in a subprocess argument. The example also stores credentials directly in shell variables. Although shell variables are preferable to literal production credentials embedded in a script, they remain sensitive and can be exposed by tracing, debugging, environment export, or unsafe error reporting. ### Attack Path 1. A user substitutes a real API secret into the documented shell workflow. 2. The shell expands `"$SECRET_KEY"` into the OpenSSL command-line argument. 3. A local user, monitoring agent, process-inspection utility, audit system, or command telemetry collector records or observes the ...[truncated 781 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer an in-process HMAC implementation, such as the documented Python `hmac` module, so the secret is not passed to a child process as an argument. 2. Load the secret at runtime from an OS keychain or managed secret store rather than embedding it in a script or project file. 3. If a subprocess is unavoidable, use a supported protected input mechanism or file descriptor that does not place the secret in the process argument list. 4. Disable shell tracing before handling secrets and ensure scripts do not run with `set -x` during signing. 5. Prevent command invocations, shell variables, headers, and credential values from being captured in logs or diagnostic output. 6. Use short-lived or narrowly scoped credentials where supported, enforce IP allowlisting, and disable transfer or withdrawal permissions unless explicitly required. 7. Rotate credentials if the vulnerable command has been executed in an environment where process arguments or command telemetry may have been retained. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The documentation explicitly tells the agent to store user API credentials in TOOLS.md, creating local secret persistence that is unnecessary for simple API request handling. Persisting exchange API keys and secrets in a workspace file can expose them to other tools, later prompts, logs, backups, or unrelated skills, enabling account compromise and unauthorized trading or withdrawals.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: This markdown skill describes its function in broad natural language ('Spot request on Aster') but does not define concrete invocation phrases, scope boundaries, or exclusion conditions. That ambiguity can increase the chance of unintended activation for general Aster-related requests.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill exposes order placement, fund transfer, and withdrawal endpoints, which can cause irreversible financial loss, but only documents a basic mainnet confirmation step. In the context of an agent skill, broad transactional capability without stronger safeguards such as per-action confirmations, parameter validation, and withdrawal restrictions is dangerous because prompt mistakes or prompt injection could trigger costly actions.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The document says secrets must never be displayed in full, yet it includes a storage template showing plaintext-style API key and secret examples. Even if illustrative, this normalizes unsafe handling of secrets and can cause downstream implementations or operators to copy the pattern into real files, defeating the masking guidance.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill’s stated purpose is making Aster Spot API requests, but the documentation expands into credential storage, account management, and local persistence behavior. That scope expansion materially increases the attack surface because a request-execution skill now instructs the agent to retain long-lived secrets outside the immediate transaction flow.

Static analysis

No suspicious patterns detected.