TradeMemory Protocol

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:07 AM UTC
• Version: 0.3.2

Overview

This trading-memory skill is mostly coherent, but it asks users to install mutable external code and store MT5 trading credentials in plaintext, so it needs careful review before use.

Review the install scripts and upstream repository before running them. Prefer a virtual environment, pin package and repository versions, avoid putting live trading credentials in plaintext .env files when possible, restrict .env permissions if used, and treat strategy adjustments as advisory unless you explicitly approve any live trading changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: scripts/install.sh:27

Finding

Unpinned PyPI Package Installation Allows Mutable Supply-Chain Code Execution

Content

View full analysis

Vulnerability Details

File Location: scripts/install.sh, lines 27-33
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: High

Complete Code Snippet

bash

# Install tradememory-protocol from PyPI
echo ""
echo "Installing tradememory-protocol..."
python3 -m pip install --upgrade tradememory-protocol

# Verify installation
echo ""
python3 -c "import tradememory; print('[OK] tradememory-protocol installed successfully')"

Technical Analysis

The installer downloads tradememory-protocol from PyPI without an exact version or cryptographic hash. The --upgrade option explicitly directs pip to select the newest release available at installation time. Consequently, the effective code installed and imported can change after this skill has been reviewed.

Python package installation may execute package build logic, while the subsequent verification command imports the installed package. A compromised package release, maintainer account, build artifact, or transitive dependency could therefore cause attacker-controlled code to run under the identity of the user invoking the script.

Attack Path

1. An attacker compromises the PyPI project, a maintainer account, its release pipeline, or a transitive dependency.
2. The attacker publishes a malicious version that remains compatible with the unrestricted installation command.
3. A user runs scripts/install.sh.
4. pip install --upgrade retrieves the attacker-controlled release.
5. Malicious code executes during package installation, build processing, or the subsequent import tradememory.
6. The payload operates with the invoking user's permissions and can access resources available to that account.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running the installer. The accessible scope may include the user's files, environment variables, ...[truncated 236 chars]

Remediation

View remediation

Remediation Suggestions

• Pin tradememory-protocol to an exact, reviewed version rather than using an unrestricted package name.
• Remove --upgrade from the installation path so later releases are not selected implicitly.
• Use a lock file or requirements file containing exact versions for all transitive dependencies.
• Require package hashes, for example through pip's --require-hashes mechanism.
• Obtain hashes from a trusted release process and verify signatures or provenance attestations where available.
• Install dependencies into a dedicated virtual environment with minimal filesystem and credential access.
• Perform verification without importing untrusted code until package integrity and provenance have been established.

T08 · Insecure Dependencies

Error

• Location: scripts/setup_mt5.sh:27

Finding

Unpinned MT5 Dependencies and Mutable Repository Clone Enable Supply-Chain Compromise

Content

View full analysis

Vulnerability Details

File Location: scripts/setup_mt5.sh, lines 27-39
Vulnerability Type: Unpinned dependencies and mutable external source retrieval
Risk Level: High

Complete Code Snippet

bash

# Install MT5 dependencies
echo "[1/4] Installing MT5 Python dependencies..."
python3 -m pip install MetaTrader5 python-dotenv requests fastapi uvicorn pydantic
echo "[OK] Dependencies installed"
echo ""

# Clone repo if not already present
REPO_DIR="tradememory-protocol"
if [ ! -d "$REPO_DIR" ]; then
    echo "[2/4] Cloning tradememory-protocol..."
    git clone https://github.com/mnemox-ai/tradememory-protocol.git
    cd "$REPO_DIR"

Technical Analysis

All six Python packages are installed without exact versions or hashes. Their versions and transitive dependency graphs are therefore resolved dynamically at installation time. The setup script also clones the default branch of an external GitHub repository without selecting or verifying a reviewed commit, signed tag, or release artifact.

The cloned repository is subsequently treated as trusted: the script enters it, reads or creates its .env file, and the documented workflow instructs users to run the repository's server and MT5 synchronization code. The .env file contains an MT5 account number, password, broker server, and API configuration. If the mutable repository or any installed package is compromised, attacker-controlled code could execute in a context containing sensitive trading credentials.

Attack Path

1. An attacker compromises one of the named PyPI packages, a transitive dependency, the GitHub repository, a maintainer account, or an associated release pipeline.
2. The attacker publishes a malicious package release or modifies the repository's default branch.
3. A user invokes scripts/setup_mt5.sh.
4. pip resolves and installs the unpinned malicious package, or Git clones the modified default branch.
5. The set ...[truncated 1124 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every Python dependency to an exact reviewed version, including transitive dependencies.
• Maintain a lock file with cryptographic hashes and install with hash verification enabled.
• Clone a specific reviewed commit hash or retrieve a signed, immutable release artifact instead of the mutable default branch.
• Verify Git commit or tag signatures and compare the resulting commit identifier against a trusted allowlist before continuing.
• Review repository code before asking users to enter credentials or execute server and synchronization modules.
• Store MT5 credentials outside the cloned source tree using an operating-system credential manager or a separately protected configuration directory.
• If an .env file must be used, create it with permissions restricted to the current user and ensure it is excluded from version control, logs, backups, and diagnostic output.
• Run the server and synchronization process in an isolated virtual environment or sandbox with only the filesystem and network access required for their stated purpose.
• Add dependency provenance and vulnerability checks to the release process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The skill is described as a trading-memory and reflection tool, but the documented behavior includes environment setup, dependency installation, repository cloning, credential configuration, and MT5 connectivity. That mismatch can mislead an agent into performing higher-risk setup and credential-handling actions than a user would reasonably expect from the declared purpose.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The skill instructs users to create and populate a .env file with MT5 login credentials, meaning the workflow handles highly sensitive financial account secrets. In the context of an agent skill, credential access is dangerous because agents or connected tooling may read, log, exfiltrate, or misuse those credentials, especially when setup also involves networked components and optional remote APIs.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

cd tradememory-protocol

# 3. Configure credentials
cp .env.example .env
# Edit .env with your MT5 login, password, server

# 4. Start the TradeMemory server

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The instruction to edit a .env file with MT5 login, password, and server details confirms direct handling of sensitive brokerage credentials. In a trading skill, compromise of these secrets could enable unauthorized account access, data harvesting, or misuse of the connected trading environment.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

# 3. Configure credentials
cp .env.example .env
# Edit .env with your MT5 login, password, server

# 4. Start the TradeMemory server
python -m src.tradememory.server

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup_mt5.sh (reported line 45)May include surrounding context.

sh

fi
echo ""

# Create .env from template
if [ ! -f ".env" ]; then
    echo "[3/4] Setting up credentials..."
    if [ -f ".env.example" ]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup_mt5.sh (reported line 49)May include surrounding context.

sh

fi
echo ""

# Create .env from template
if [ ! -f ".env" ]; then
    echo "[3/4] Setting up credentials..."
    if [ -f ".env.example" ]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup_mt5.sh (reported line 51)May include surrounding context.

sh

fi
echo ""

# Create .env from template
if [ ! -f ".env" ]; then
    echo "[3/4] Setting up credentials..."
    if [ -f ".env.example" ]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup_mt5.sh (reported line 65)May include surrounding context.

sh

fi
echo ""

# Create .env from template
if [ ! -f ".env" ]; then
    echo "[3/4] Setting up credentials..."
    if [ -f ".env.example" ]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup_mt5.sh (reported line 70)May include surrounding context.

sh

fi
echo ""

# Create .env from template
if [ ! -f ".env" ]; then
    echo "[3/4] Setting up credentials..."
    if [ -f ".env.example" ]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup_mt5.sh (reported line 72)May include surrounding context.

sh

fi
echo ""

# Create .env from template
if [ ! -f ".env" ]; then
    echo "[3/4] Setting up credentials..."
    if [ -f ".env.example" ]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup_mt5.sh (reported line 101)May include surrounding context.

sh

fi
echo ""

# Create .env from template
if [ ! -f ".env" ]; then
    echo "[3/4] Setting up credentials..."
    if [ -f ".env.example" ]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup_mt5.sh (reported line 46)May include surrounding context.

sh

echo ""

# Create .env from template
if [ ! -f ".env" ]; then
    echo "[3/4] Setting up credentials..."
    if [ -f ".env.example" ]; then
        cp .env.example .env

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises capabilities that involve network access and environment-variable handling, but it does not declare an explicit tool scope such as allowed tools or permissions. This creates ambiguity for agents and users about what the skill may access, increasing the risk of over-broad execution or unintended exposure of secrets during installation or runtime.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill promotes 'automatic strategy adjustments' for trading behavior without a strong warning that these outputs can influence financial decisions. In a trading context, automation that changes risk recommendations or disables/enables strategies can materially affect user finances if applied without review.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

**File system access:** TradeMemory writes to a single SQLite database file (`tradememory.db`) in the project directory. No files are created or modified outside the project.

**No implicit permissions:** This skill does not auto-install dependencies, modify system files, or require elevated privileges. All setup steps are explicit and user-initiated.

## Available Commands

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill encourages broad natural-language triggering such as 'tell your agent these things in natural language,' without clear trigger boundaries or confirmation requirements. In an agent setting, this can cause accidental invocation of state-changing actions like recording data, querying sensitive history, or initiating reflections based on ambiguous user input.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script instructs the user to place MT5 credentials into a local .env file and does not warn about plaintext secret storage, file permissions, or accidental inclusion in version control. In a trading context, these credentials can enable account access and trade activity, so insecure local handling creates real exposure even if the script is not overtly exfiltrating them.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

**File system access:** TradeMemory writes to a single SQLite database file (`tradememory.db`) in the project directory. No files are created or modified outside the project.

**No implicit permissions:** This skill does not auto-install dependencies, modify system files, or require elevated privileges. All setup steps are explicit and user-initiated.

## Available Commands

Static analysis

No suspicious patterns detected.