Quant Trader

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:43 AM UTC
• Version: 1.0.0

Overview

This trading skill is coherent, but it should be reviewed because it installs an unpinned external trading project before asking users to supply exchange credentials for live trading.

Before installing, treat this as a high-impact trading tool: review the GitHub repository and dependency list, pin or verify the exact revision, use a virtual environment, start only with paper trading or testnet, and use exchange API keys with the minimum permissions possible and no withdrawal capability.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:20

Finding

Unpinned Remote Repository and Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20-29
Vulnerability Type: Unverified remote source and dependency installation
Risk Level: High

Complete Code Snippet:

bash

# Clone repository
git clone https://github.com/ZhenRobotics/openclaw-quant.git ~/openclaw-quant
cd ~/openclaw-quant

# Install dependencies
pip install -r requirements.txt

# Set API keys (optional for backtesting)
export BINANCE_API_KEY="your-key"
export BINANCE_API_SECRET="your-secret"

The equivalent instructions also appear in SKILL-ZH.md, lines 20-29.

Technical Analysis

The installation procedure clones the mutable default branch of an external Git repository and immediately installs packages from its externally controlled requirements.txt. It does not pin the repository to a reviewed commit, verify a release signature or checksum, require dependency hashes, or direct installation into an isolated environment.

Consequently, the code and dependency definitions installed by users can differ from the version that was originally reviewed. Python package installation may execute build-system hooks or setup logic under the installing user's privileges. A compromise of the upstream repository, its maintainer account, or one of its dependencies could therefore result in arbitrary code execution during installation.

The audited project contains only documentation, so no malicious remote payload was directly observed. This finding concerns the unsafe and unverifiable installation trust chain documented by the Skill.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or a dependency referenced by requirements.txt.
2. The attacker modifies the default branch or dependency resolution path to include malicious package installation or build logic.
3. A user follows the Skill instructions and clones the latest mutable repository state.
4. The user runs `pip install -r ...[truncated 1321 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the remote repository to a specific reviewed commit or cryptographically signed release rather than cloning a mutable default branch.
2. Publish and verify an expected commit identifier, release signature, or SHA-256 checksum before installation.
3. Pin every Python dependency and transitive dependency to an exact reviewed version using a generated lockfile.
4. Require package hashes, such as through pip install --require-hashes -r requirements.txt.
5. Install inside a dedicated virtual environment or similarly isolated runtime under a non-privileged account.
6. Avoid configuring exchange credentials until repository and dependency integrity checks have completed.
7. Recommend exchange API keys with only the minimum required permissions, no withdrawal capability, symbol or account restrictions where supported, and IP allowlisting.
8. Use testnet or paper-trading mode by default and require separate, explicit confirmation before enabling live trading.
9. Audit the resolved repository revision and complete dependency graph before presenting the installation as trusted.
10. Apply the same hardened installation instructions to both SKILL.md and SKILL-ZH.md.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown skill forces a specific language/locale for installation, usage, safety guidance, and agent behavior instructions. The file does not indicate that Chinese is optional, nor does it justify the locale as region-specific, which can violate language-choice policy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.