Security audit

agent-trading-atlas

Security checks for vulnerabilities and agentic risk

Overview

This is a documented trading-record integration, but it needs review because it can send detailed trading analysis to an external service, persist API keys locally, and follow remotely fetched workflow packages.

Install only if you are comfortable sending trading decisions and related metadata to Agent Trading Atlas. Use a dedicated low-scope API key where possible, store it in a real secret manager or tightly permissioned file, avoid project .env and shell history exposure, pin the installer/source to a reviewed version, and do not enable autonomous operation or remotely fetched workflow packages unless you review the package contents and execution permissions first.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

Location: README.md:19
Finding: Unpinned Installer and Mutable Repository Installation
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Warning

Location: references/workflow-guide.md:72
Finding: Remote Workflow Packages Can Supply Local Instructions and Generated Scripts Without Integrity Verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: references/getting-started.md:179
Finding: API Key May Be Persisted in Plaintext Shell or Project Files
Content: View full analysis
~/.ata/ata.json << 'EOF' { "api_key": "ata_sk_live_...", "agent_id": "my-rsi-scanner-v2" } EOF chmod 600 ~/.ata/ata.json ``` Any agent or tool can read `~/.ata/ata.json` to find the key without depending on shell environment or a specific IDE. The `agent_id` field is optional but convenient for agents that always use the same identity. ### Alternative: Shell environment ```bash echo 'export ATA_API_KEY="ata_sk_live_..."' >> ~/.zshrc source ~/.zshrc ``` ### Alternative: Project .env file ```bash echo 'ATA_API_KEY=ata_sk_live_...' >> .env # Ensure .env is in .gitignore ``` ``` ### Technical Analysis The primary configuration-file method applies mode `600`, which is a useful protection. However, the alternative instructions persist the production API key in shell initialization files or a project `.env` without enforcing restrictive permissions. A `.gitignore` reminder does not guarantee that the file will not already be tracked, copied into an archive or container image, exposed to development tools, or accidentally committed. Shell startup files are also commonly processed by unrelated terminal and automation tooling. In addition, entering a ...[truncated 1100 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Credential Access

High

Category: Privilege Escalation
Confidence: 78% confidence
Finding: The documentation recommends storing a long-lived API key in agent-discoverable locations such as a plaintext home-directory config, shell startup files, or project .env files. In an agent ecosystem, making secrets broadly readable by tools or exposing them through developer workflows increases the chance of unintended credential access, reuse, or leakage via backups, prompts, logs, or repository mistakes.
Content: Scanner excerpt · references/getting-started.md (reported line 185)May include surrounding context.
md
|----------|--------|----------|-------| | 1 (recommended) | **ATA config file** | `~/.ata/ata.json` | Dedicated, agent-discoverable, works with any tool | | 2 | **Shell environment** | `~/.zshrc` or `~/.bashrc` | Works everywhere via `export ATA_API_KEY=...` | | 3 | **Project .env file** | `.env` in project root | Per-project isolation (ensure `.env` is in `.gitignore`) | ### Recommended: `~/.ata/ata.json`

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: Appending an API key directly into a project .env file creates a plaintext secret in the workspace, where it may be read by tools, accidentally committed, copied into artifacts, or exposed through debugging and prompt-context collection. In a skill intended for agents, project-local plaintext secret storage is more dangerous because multiple tools may automatically ingest repository files.
Content: Scanner excerpt · references/getting-started.md (reported line 209)May include surrounding context.
source ~/.zshrc

text
### Alternative: Project .env file ```bash echo 'ATA_API_KEY=ata_sk_live_...' >> .env

Credential Access

High

Category: Privilege Escalation
Confidence: 87% confidence
Finding: The note to keep .env in .gitignore helps but does not eliminate the core issue that the secret remains in plaintext within the project tree. Secrets in workspace files are still vulnerable to local disclosure, accidental sharing outside git, inclusion in archives, or exposure to other agent/tooling processes.
Content: Scanner excerpt · references/getting-started.md (reported line 212)May include surrounding context.
Alternative: Project .env file

bash
echo 'ATA_API_KEY=ata_sk_live_...' >> .env # Ensure .env is in .gitignore

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/getting-started.md (reported line 213)May include surrounding context.
bash
echo 'ATA_API_KEY=ata_sk_live_...' >> .env # Ensure .env is in .gitignore

Multi-agent setups

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill description and repeated guidance encourage use whenever an agent analyzes stocks, makes trading decisions, reviews market performance, or inspects similar setups, which is broad enough to trigger in many routine finance tasks. Because the skill connects to an external service for querying and submitting decision records, overbroad invocation increases the chance of unnecessary external data sharing and unintended reliance on third-party workflow guidance in contexts where ATA is not actually needed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The top-level description emphasizes analysis support and 'shared experience' but does not clearly foreground that trading decisions, metadata, and later outcomes may be sent to and tracked by an external service. In a finance context, this omission is risky because users may expose proprietary strategies, identifiers, timing information, or regulated business data without realizing the skill performs external submission and ongoing tracking.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 45)May include surrounding context.
Quick Path: One Call (email + password)

bash
export ATA_BASE="https://api.agenttradingatlas.com/api/v1" curl -sS "$ATA_BASE/auth/quick-setup" \ -H "Content-Type: application/json" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/getting-started.md (reported line 20)May include surrounding context.
Quick Path: One Call (email + password)

bash
export ATA_BASE="https://api.agenttradingatlas.com/api/v1" curl -sS "$ATA_BASE/auth/quick-setup" \ -H "Content-Type: application/json" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/getting-started.md (reported line 37)May include surrounding context.
Quick Path: One Call (email + password)

bash
export ATA_BASE="https://api.agenttradingatlas.com/api/v1" curl -sS "$ATA_BASE/auth/quick-setup" \ -H "Content-Type: application/json" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/getting-started.md (reported line 22)May include surrounding context.
bash
export ATA_BASE="https://api.agenttradingatlas.com/api/v1" curl -sS "$ATA_BASE/auth/quick-setup" \ -H "Content-Type: application/json" \ -d '{ "email": "agent@example.com",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/getting-started.md (reported line 79)May include surrounding context.
DEVICE_CODE=$(printf '%s' "$DEVICE_JSON" | jq -r '.device_code')

Poll every interval seconds until authorized

curl -sS "$ATA_BASE/auth/github/device/poll"
-H "Content-Type: application/json"
-d "{"device_code": "$DEVICE_CODE"}"

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/getting-started.md (reported line 125)May include surrounding context.

Create the API key with the session token.

bash
curl -sS "$ATA_BASE/auth/api-keys" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $SESSION_TOKEN" \ -d '{

Session Persistence

Medium

Category: Rogue Agent
Confidence: 82% confidence
Finding: The recommended persistent storage of a reusable API key in ~/.ata/ata.json creates a durable credential artifact specifically designed for broad agent discoverability. In this skill's context, that increases the blast radius: any local process, plugin, or compromised agent running as the same user can potentially harvest the key and impersonate the account over time.
Content: Scanner excerpt · references/getting-started.md (reported line 190)May include surrounding context.
Recommended: ~/.ata/ata.json

bash
mkdir -p ~/.ata cat > ~/.ata/ata.json << 'EOF' { "api_key": "ata_sk_live_...",

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/getting-started.md (reported line 197)May include surrounding context.
"agent_id": "my-rsi-scanner-v2" } EOF chmod 600 ~/.ata/ata.json

text
Any agent or tool can read `~/.ata/ata.json` to find the key without depending on shell environment or a specific IDE. The `agent_id` field is optional but convenient for agents that always use the same identity.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The phrase "Use this for autonomous agent operation, quota management, and owner-side review context" is a very broad invocation description in a markdown file. It does not define specific triggers, scope boundaries, or exclusion conditions, so it could overlap with many routine requests about operations or quotas.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The section 'Use this when you want the agent to operate without manual prompting' plus the recommended cadence and six-step loop materially encourages autonomous recurring behavior without embedding stronger scope guards, approval requirements, or environment constraints. In a trading-agent skill, ambiguous autonomy guidance is more dangerous because it can lead to repeated market-facing actions, quota consumption, or unintended submissions if an integrating agent treats documentation as operational instruction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file instructs agents to submit structured trading decisions and associated metadata to a remote API, including agent identifiers, timestamps, tool usage, reasoning, market context, and optional review traces, but it does not include a clear user-facing warning or consent step about external data transmission. In an agent setting, this can cause unintentional exfiltration of proprietary strategies, sensitive operational metadata, or user-confidential analysis to a third-party service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The documentation shows authenticated API usage with a bearer token and later encourages fetching full raw records, but it does not mention basic credential-handling hygiene or the sensitivity of retrieved data. In a shared trading-experience system, raw records may contain proprietary reasoning, timestamps, aliases, or other sensitive historical data, so omission of privacy guidance can lead to accidental exposure through logs, prompts, transcripts, or insecure storage.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

SkillSpector

Credential Access

Credential Access

Credential Access

Alternative: Project .env file

Credential Access

Multi-agent setups

Rp1

Vague Triggers

Missing User Warnings

External Transmission

Quick Path: One Call (email + password)

External Transmission

Quick Path: One Call (email + password)

External Transmission

Quick Path: One Call (email + password)

External Transmission

External Transmission

Poll every interval seconds until authorized

External Transmission

Session Persistence

Recommended: ~/.ata/ata.json

Sudo/Root Execution

Vague Triggers

Vague Triggers

Missing User Warnings

Missing User Warnings

Static analysis

Poll every `interval` seconds until authorized

Recommended: `~/.ata/ata.json`