T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:20- Finding
Unpinned Remote Payload Retrieval and Dependency Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Quant Analyst
Security checks for vulnerabilities and agentic risk
Overview
This package mixes a cryptocurrency trading skill with an unrelated video-generation skill file and asks users to run unpinned external code with sensitive API credentials.
Review this carefully before installing. Do not use production exchange credentials unless the package is corrected, live-trading behavior is clearly scoped, and keys are least-privilege, withdrawal-disabled, IP-restricted, and preferably testnet first. The publisher should remove or separate the video-generator file, pin reviewed repository commits and dependencies, and avoid shell-interpolating user content.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL-EN.md:81- Finding
Shell Command Injection Through Interpolated Video Script Content
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Introducing Git clone, package installation, API-key handling, and shell execution into a quantitative trading skill is unjustified and materially expands the agent's privileges. In context, this looks like capability smuggling: a user invoking a finance-related skill could be induced to fetch and run unrelated third-party code, exposing the host to supply-chain compromise, secret leakage, or arbitrary code execution.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The auto-trigger rules match broad terms like 'video' or generic multi-sentence text, making accidental activation likely. In a mismatched skill that executes external projects, broad triggering increases the chance that ordinary conversation routes into shell commands and network actions without informed user intent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill metadata says this is a cryptocurrency quantitative trading skill, but the content is a video-generation workflow that directs the agent to clone a GitHub repository, install dependencies, set API keys, and execute local shell scripts. This mismatch is dangerous because it can smuggle unrelated code-execution capabilities past users and policy boundaries under a trusted skill identity.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The examples say to 'always use this skill' for broad phrases, which encourages over-selection without verifying user intent or task fit. In this file's context, that can steer benign requests into an unrelated external-code execution workflow, increasing exposure to unsafe actions.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md **DON'T**: - ❌ Run `npx remotion` to create new projects - ❌ Assume project is installed without checking - ❌ Ignore error messages - ❌ Use hardcoded absolute paths (except `~` paths)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
触发关键词中包含“量化”“交易策略”等较宽泛表述，容易在用户仅讨论分析、教育或一般市场信息时误激活该技能。由于该 skill 涉及回测、模拟盘乃至实盘交易，误触发可能导致代理进入高风险金融操作流程、请求敏感 API 凭据，或在上下文不足时给出不恰当的交易执行建议。
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The document repeatedly describes paper trading, parameter optimization, and live trading as available current features, with usage examples and CLI commands at L44-L53, L149-L179, and L187-L199. However, the roadmap at L490-L503 says those same capabilities arrive only in later versions, creating an active contradiction in the skill's own stated intent and availability.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The installation guide instructs users to export real Binance API credentials directly into their shell environment without an immediate warning about secret handling, scope restriction, or use of testnet/least-privilege keys. In a trading skill that also supports live trading, this increases the chance that users expose production credentials to shell history, logs, screenshots, shared terminals, or later agent/tool access.
- Content
Static analysis
No suspicious patterns detected.