Security audit

SMC Multi-Strategy Paper Trader

Security checks for vulnerabilities and agentic risk

Overview

This paper-trading skill is purpose-adjacent, but it under-discloses that several scripts read a local GitHub token and try to upload portfolio data to a fixed GitHub repository.

Review before installing. Run only in an isolated environment or after removing/disabling the GitHub push blocks, and do not keep a ~/.github_token available to these scripts unless you intentionally want portfolio data synced to the hard-coded repository on a recurring schedule.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/paper-monitor-v5.js:505
Finding: Undisclosed GitHub Credential Access and Remote Portfolio Export
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/macro-rotation.js:855
Finding: Shell Command Injection and GitHub Token Exposure in Macro Portfolio Synchronization
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (74)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding suggests the implemented skill performs authenticated GitHub API writes and uses local credentials while omitting major declared orchestration and macro features. This is dangerous because the misleading presentation lowers operator suspicion and may cause them to grant execution to a skill that can access secrets and modify external systems without informed consent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding suggests the implemented skill performs authenticated GitHub API writes and uses local credentials while omitting major declared orchestration and macro features. This is dangerous because the misleading presentation lowers operator suspicion and may cause them to grant execution to a skill that can access secrets and modify external systems without informed consent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The finding suggests the implemented skill performs authenticated GitHub API writes and uses local credentials while omitting major declared orchestration and macro features. This is dangerous because the misleading presentation lowers operator suspicion and may cause them to grant execution to a skill that can access secrets and modify external systems without informed consent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The finding suggests the implemented skill performs authenticated GitHub API writes and uses local credentials while omitting major declared orchestration and macro features. This is dangerous because the misleading presentation lowers operator suspicion and may cause them to grant execution to a skill that can access secrets and modify external systems without informed consent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The finding suggests the implemented skill performs authenticated GitHub API writes and uses local credentials while omitting major declared orchestration and macro features. This is dangerous because the misleading presentation lowers operator suspicion and may cause them to grant execution to a skill that can access secrets and modify external systems without informed consent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding suggests the implemented skill performs authenticated GitHub API writes and uses local credentials while omitting major declared orchestration and macro features. This is dangerous because the misleading presentation lowers operator suspicion and may cause them to grant execution to a skill that can access secrets and modify external systems without informed consent.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.
md
- **Macro Rotation** (`macro-rotation.js`) — LTPI/MTPI + Relative Strength Tournament, daily rebalance, $10K capital

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
md
- **Macro Rotation** (`macro-rotation.js`) — LTPI/MTPI + Relative Strength Tournament, daily rebalance, $10K capital

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.
md
- **Macro Rotation** (`macro-rotation.js`) — LTPI/MTPI + Relative Strength Tournament, daily rebalance, $10K capital

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.
md
- **Regime Scorer** (`regime-scorer.js`) — 15 TA indicators + 5 FRED liquidity factors → STPI/MTPI/LTPI scores

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
- **Regime Scorer** (`regime-scorer.js`) — 15 TA indicators + 5 FRED liquidity factors → STPI/MTPI/LTPI scores

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.
md
- **Regime Scorer** (`regime-scorer.js`) — 15 TA indicators + 5 FRED liquidity factors → STPI/MTPI/LTPI scores

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
md
- **v6 Day Monitor** (`paper-monitor-v6.js`) — SMC+TA≥5 gated by STPI ≥ 0.5

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
md
- **v6 Day Monitor** (`paper-monitor-v6.js`) — SMC+TA≥5 gated by STPI ≥ 0.5

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.
md
- **v6 Day Monitor** (`paper-monitor-v6.js`) — SMC+TA≥5 gated by STPI ≥ 0.5

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.
md
- **Swing v2** (`paper-monitor-swing-v2.js`) — Swing strategy gated by MTPI ≥ 0.5

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
md
- **Swing v2** (`paper-monitor-swing-v2.js`) — Swing strategy gated by MTPI ≥ 0.5

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.
md
- **Swing v2** (`paper-monitor-swing-v2.js`) — Swing strategy gated by MTPI ≥ 0.5

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
| Swing | `paper-monitor-swing.js` | Daily BoS + 4H FVG | EMA | 72h | 5 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.
md
| Swing | `paper-monitor-swing.js` | Daily BoS + 4H FVG | EMA | 72h | 5 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
md
| Day v5 | `paper-monitor-v5.js` | 1H BoS + FVG + CVD | None | 12h | 10 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
md
| Day v5 | `paper-monitor-v5.js` | 1H BoS + FVG + CVD | None | 12h | 10 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
md
| Coordinated | `paper-monitor-coordinated.js` | 1H + 4H mixed | Lock | varies | 10 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
| Coordinated | `paper-monitor-coordinated.js` | 1H + 4H mixed | Lock | varies | 10 |

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill metadata claims Binance-public-only operation with no credentials, but the code reads a local GitHub token from ~/.github_token and performs authenticated repository writes. This hidden credential use materially changes the trust boundary: running the skill can access secrets and exfiltrate portfolio data to a third-party service despite the stated no-credentials design.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/macro-rotation.js:68

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/regime-scorer.js:158