Alpaca Py Cli

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:29 PM UTC
• Version: 2.0.0

Overview

This trading skill is not clearly malicious, but it gives agents high-impact financial and credential-handling workflows with inconsistent consent boundaries and risky plaintext secret persistence.

Install only after carefully reviewing the credential and trading implications. Prefer completing Alpaca registration, email verification, API key generation, and credential entry yourself in a trusted session; use paper-trading keys first; avoid live-trading credentials unless you understand that shell-stored environment variables may be readable by agents and local processes; rotate keys if they were exposed to an agent transcript or shell profile you do not trust.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:360

Finding

Agent-Directed Extraction and Handling of Financial Trading Credentials

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:89

Finding

Persistent Plaintext Trading Secrets Stored in Shell Startup Files

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:66

Finding

Unpinned Third-Party Packages Installed and Executed Without Integrity Verification

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The setup workflow states that the agent runs alpaca init, which conflicts with earlier guidance not to run setup autonomously without explicit permission. In a trading skill, normalizing agent-initiated setup can lead to shell config modification, credential collection workflows, and persistent secret exposure in environments where the user may not fully understand or approve the trust boundary.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

These lines tell agents to use browser automation to obtain API keys and then call a command that saves them persistently in shell startup files. Directing an agent to both acquire and install secrets creates a clear secret-handling vulnerability, because any agent compromise, logging, prompt injection, or mis-execution could expose credentials or alter the user's environment without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The automated setup section directs handling of highly sensitive personal and credential data during signup, email verification, API key generation, and secret installation, but it does not establish strong prohibitions on collection, retention, or exposure of those secrets. That omission makes it more likely an agent will capture or persist credentials insecurely, especially because the workflow normalizes secret extraction as part of setup.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The workflow explicitly instructs agents to generate a new API key pair, extract both keys, and save them to shell configuration. This is dangerous because it operationalizes end-to-end automated secret acquisition and persistence, giving the agent direct access to credentials capable of trading actions and making accidental leakage, unauthorized reuse, or hostile exfiltration much more plausible.

Content

No source excerpt is available for this finding.

Ssd 4

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example agent flow presents signup, email verification, API key extraction, and local secret installation as a normal integrated automation path. Normalizing this pattern is dangerous because it encourages agents to cross multiple trust boundaries—identity, email, financial account, and local machine configuration—in one flow, greatly magnifying the consequences of mistakes or abuse.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The quick summary reiterates that agents should use browser automation to complete registration, extract API keys, and save them. Repetition in the summary increases the likelihood of downstream execution by agents or toolchains that only ingest condensed instructions, reinforcing unsafe secret-handling behavior in a financial context.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup.json (reported line 43)May include surrounding context.

json

"   Run: alpaca auth",
    "   This will prompt for API Key, Secret Key, and trading mode (Paper/Live)",
    "   Credentials are saved to your shell config (~/.zshrc, ~/.bashrc, or ~/.profile)",
    "5. Get API keys from https://alpaca.markets (Dashboard → API Keys)",
    "   - Use Paper Trading keys for testing (virtual $100k, no real money)",
    "   - Use Live Trading keys only after thorough testing",
    "6. If using Homebrew Python, update the alpaca script shebang:",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The Quick Start section prominently tells users to run alpaca init but does not repeat the nearby operational risk that the command modifies shell startup files and persists API keys. Users who jump directly to Quick Start may initiate credential setup without understanding persistence, shell config changes, or that agents with shell access may later read those variables.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README makes a contradictory safety claim: it says API keys stored in shell configuration are accessible to processes in the shell, then later asserts an agent cannot access keys directly. In an agent-with-shell-access context, that statement can mislead users into granting setup or execution permissions under a false assumption of key isolation, increasing the risk of credential exposure and unauthorized trading actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The metadata says setup requires user interaction and warns not to run setup autonomously, but later sections say agents can automate registration and then save credentials. This contradictory guidance can cause downstream agents to bypass consent boundaries or treat sensitive setup steps as implicitly approved, increasing the chance of unauthorized actions on the user's system and accounts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs agents to use browser and email automation to register an Alpaca account, generate API keys, extract them, and proceed with setup. That expands the skill from trading operations into automated identity, account-creation, and credential-handling workflows, which materially increases the attack surface and creates a path for unauthorized collection or misuse of sensitive credentials.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The example activation uses a broad prompt such as a user wanting to 'start trading stocks,' which can cause the skill to engage on generic investing requests and then steer into account creation and secret-handling flows. In this context, broad triggering is risky because the skill includes credential persistence and automated onboarding behavior, not just harmless informational responses.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The setup instructions direct users to enter Alpaca API credentials and explicitly state they will be saved to shell startup files such as ~/.zshrc or ~/.bashrc, but they do not warn about the security implications of storing secrets in plaintext in broadly read configuration files. This can expose trading credentials to local compromise, accidental disclosure through backups/dotfile sync, or leakage during support/debugging, especially if users later enable live trading.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.