Security audit

Bitstamp Trader

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Bitstamp trading helper, but its live-trading safety controls have material weaknesses that warrant review before installation.

Install only if you understand this can place real Bitstamp trades with your API key. Use an API key with no withdrawal permission, enable IP allowlisting, pin and review the ccxt dependency, and do not rely on the daily cap or kill switch as fully reliable until the locking, cancellation reporting, and numeric validation issues are fixed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

Location: scripts/bitstamp.py:39
Finding: Unpinned privileged CCXT dependency creates supply-chain risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/bitstamp.py:136
Finding: Race condition allows concurrent orders to exceed the daily trading limit
Content: View full analysis
float: today = datetime.now(timezone.utc).strftime("%Y-%m-%d") if DAILY_VOLUME_FILE.exists(): with open(DAILY_VOLUME_FILE) as f: data = json.load(f) if data.get("date") == today: return data.get("volume_usd", 0.0) return 0.0 def add_daily_volume(amount_usd: float): today = datetime.now(timezone.utc).strftime("%Y-%m-%d") current = get_daily_volume() CONFIG_DIR.mkdir(parents=True, exist_ok=True) with open(DAILY_VOLUME_FILE, "w") as f: json.dump({"date": today, "volume_usd": current + amount_usd}, f) ``` The safety check is separate from order submission and accounting: ```python daily_vol = get_daily_volume() if daily_vol + est_usd > cfg["max_daily_volume_usd"]: print(f"🚫 Daily volume limit would be exceeded.") print(f" Used today: ${daily_vol:,.2f} / ${cfg['max_daily_volume_usd']:,.2f}") print(f" This order: ${est_usd:,.2f}") ``` For a live buy, the exchange order is created before the local total is updated: ```python if args.price: order = exchange.create_limit_buy_order(market, args.amount, args.price) else: order = exchange.create_market_buy_order(market, args.amount) add_daily_volume(est_usd) ``` The live sell path uses the same pattern: ```python if args.price: order = exchange.create_limit_sell_order(market, args.amount, args.price) else: order = exchange.create_market_sell_order(market, args.amount) add_daily_volume(est_usd) ``` ### Technical Analysis Daily-volume enforcement is a time-of-check/time-of-use operation. Reading the current volume, testing the limit, creating an exchange order, and updating the JSON file are independent op ...[truncated 1766 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/bitstamp.py:452
Finding: Kill switch falsely reports that failed order cancellations succeeded
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/bitstamp.py:200
Finding: Non-finite and non-positive values can bypass local trading guardrails
Content: View full analysis
cfg["max_order_size_usd"]: print(f"🚫 Order exceeds max size (${cfg['max_order_size_usd']:,.2f}). Rejected.") ``` The daily-limit comparison has the same weakness: ```python daily_vol = get_daily_volume() if daily_vol + est_usd > cfg["max_daily_volume_usd"]: print(f"🚫 Daily volume limit would be exceeded.") ``` Configuration values are converted to floats but not validated: ```python default_val = DEFAULT_CONFIG[key] if isinstance(default_val, float): value = float(value) elif isinstance(default_val, list): value = [v.strip() for v in value.split(",")] cfg[key] = value save_config(cfg) ``` The CLI similarly accepts any value understood by Python's `float()` conversion: ```python p = sub.add_parser("buy", help="Place a buy order") p.add_argument("amount", type=float, help="Amount to buy (in base currency)") p.add_argument("--price", "-p", type=float, help="Limit price (omit for market order)") p = sub.add_parser("sell", help="Place a sell order") p.add_argument("amount", type=float, help="Amount to sell (in base currency)") p.add_argument("--price", "-p", type=float, help="Limit price (omit for market order)") ``` ### Technical Analysis Python accepts values such as `nan`, `inf`, negative numbers, and zero through `float()`. The application does not enforce that order amounts, prices, or safety limits are fini ...[truncated 1810 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (27)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
All commands use the script at `scripts/bitstamp.py`. Run via:

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill exposes sensitive capabilities related to environment access and file read/write, but it does not declare any explicit tool scope or permissions boundaries. In a trading skill, this is especially dangerous because environment variables are expected to contain Bitstamp API credentials, and file access could enable unauthorized reading or persistence of sensitive data, making the agent's effective privileges broader than the user can easily assess.
Content: No source excerpt is available for this finding.

Tainted flow: 'LOG_FILE' from os.environ.get (line 51, credential/environment) → open (file write)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/bitstamp.py (reported line 77)May include surrounding context.
python
"action": action, **details, } with open(LOG_FILE, "a") as f: f.write(json.dumps(entry) + "\n") return entry

Static analysis

No suspicious patterns detected.