Yubit Exchange Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:00 AM UTC
• Version: 1.0.6

Overview

This Yubit exchange skill matches its stated purpose, but it needs review because it can perform real trading and wallet-transfer actions and installs an unpinned npm runtime.

Install only if you trust the Yubit npm package and are comfortable granting it exchange-account access. Use restricted API credentials where possible, avoid enabling withdrawal-like permissions unless needed, and manually confirm every trade, leverage/mode change, close, TP/SL update, and wallet transfer before allowing it to run.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned External npm Dependency Supplies Privileged Exchange Runtime

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:10
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"author":"yubit","version":"1.0.6","openclaw":{"emoji":"📈","requires":{"bins":["yubit"]},"install":[{"id":"npm","kind":"node","package":"@yubit/exchange-skill","bins":["yubit"],"label":"Install yubit CLI (npm)"}]}}

Technical Analysis

The Skill declares automatic installation of the external npm package @yubit/exchange-skill without an exact version or integrity hash. Consequently, installation may resolve to a package release different from the one assessed when this Skill was reviewed.

The external package supplies the yubit executable and effective MCP implementation. That implementation is not included in the audited project, which contains only SKILL.md. Its behavior—including lifecycle scripts, credential handling, network communication, and exchange requests—therefore cannot be verified from this artifact.

This is a supply-chain weakness rather than proof that the current npm package is malicious. However, because the dependency implements authenticated financial operations, compromise of its publisher account, package contents, or transitive dependencies could have severe consequences.

Attack Path

1. An attacker compromises the npm publisher account, package publication workflow, registry artifact, or an unresolved transitive dependency.
2. The attacker publishes a malicious release under @yubit/exchange-skill.
3. A user installs this Skill where the unversioned package reference resolves to that malicious release.
4. Malicious code executes through npm lifecycle behavior or when the installed yubit executable is invoked.
5. The code accesses credentials and capabilities available to the process or alters authenticated exchange operations.
6. Depending on the configured account permissions, the attacker may steal sen ...[truncated 720 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @yubit/exchange-skill to a specifically reviewed, immutable version rather than allowing npm to resolve a floating release.
2. Record and verify the package integrity hash and registry provenance.
3. Lock the complete transitive dependency graph with a committed lockfile where the installation framework supports one.
4. Review the corresponding package source, build process, npm lifecycle scripts, and credential-handling behavior before distribution.
5. Use reproducible builds and verify that the published npm artifact matches the reviewed source.
6. Disable npm lifecycle scripts during installation where they are unnecessary.
7. Monitor the dependency and its transitive packages for ownership changes, unexpected releases, and known vulnerabilities.
8. Run the CLI with least privilege and use exchange credentials restricted to only the required read or trading capabilities.
9. Require explicit user confirmation or independently enforced policy controls for high-impact financial writes, even if the installed runtime is compromised.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This section exposes multiple high-impact financial write operations such as order placement, leverage changes, margin-mode switches, position closing, and wallet transfers, but it does not establish an upfront mandatory risk warning or user-consent boundary before these capabilities are described and used. Even though later rules discuss post-verification, that only checks execution state; it does not mitigate the core risk of the agent initiating consequential financial actions without an explicit pre-action warning and confirmation policy.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation scope is extremely broad: it directs use of the skill whenever a user wants to do anything on the Yubit exchange, including both harmless queries and high-impact write actions. In an agent setting, broad auto-selection increases the chance the skill is invoked in ambiguous contexts and exposes powerful trading and transfer capabilities without tighter gating or explicit intent checks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The repeated instruction to use the skill whenever the user wants to do anything on Yubit reinforces overbroad triggering and can cause the agent to route many ordinary or ambiguous requests into a highly privileged skill. Because the skill includes fund transfers and order placement, unnecessary invocation materially increases the attack surface and likelihood of unintended financial actions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 668)May include surrounding context.

md

The following MCP tools are registered under "yubit":

### Read-only (no confirmation needed)
- `getTicker(symbol)` — price, 24h change, volume, funding rate
- `getOrderbook(symbol)` — bid/ask depth
- `getKlines(symbol, interval, limit?, start?, end?)` — last-price candlestick data (OHLCV). `start`/`end` are ms timestamps and must come as a pair.

Static analysis

No suspicious patterns detected.