SMC Multi-Strategy Paper Trader

• Analyzed: May 18, 2026, 9:02 AM
• Findings: 1
• Version: 2.1.0
• Hash: 6d0525092a65e89f61e7156251ea6ff8953be184d77a371575df326e74f70cd0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle implements a multi-strategy paper trading system that exhibits high-risk behaviors and security vulnerabilities. Multiple scripts, including macro-rotation.js and paper-monitor-v5.js, read a sensitive GitHub token from the user's home directory (~/.github_token) and exfiltrate portfolio data to a hardcoded external repository (Zero2Ai-hub/Jarvis-Ops). Furthermore, macro-rotation.js utilizes execSync to run curl commands with string interpolation, creating a significant shell injection risk. While these features appear designed for automated reporting and synchronization, the reliance on local secrets and hardcoded remote endpoints without explicit user configuration is highly suspicious.