base-trader

ISSUES FOUND max severity CRITICALSkillSpector Caution 0 registry clawhub.ai last scanned 2026-02-05 1 scan

12 findings (1 critical, 4 high, 4 medium, 3 low), mainly command injection, data exfiltration, unauthorized tool use. Most recent scan 2026-02-05.

This skill presents CRITICAL and HIGH severity security risks. The primary concerns are: (1) hardcoded credential paths creating exposure risk, (2) complete dependency on an unverified external trading tool (bankr) enabling tool poisoning, (3) command injection vulnerabilities in parameter handling, (4) lack of enforcement for stated safety limits allowing unbounded automated trading, and (5) deceptive framing of high-risk gambling as systematic trading. The skill handles financial transactions and credentials but lacks fundamental security controls like input validation, credential protection, and circuit breakers. The automated trading features could lead to significant financial loss if exploited or if the external bankr tool is compromised. The 'launch sniping' functionality promotes extremely high-risk behavior (80% expected loss rate) with inadequate warnings. Immediate remediation is required before this skill should be used in any production environment.
Scanner's overall assessment (LLM analyzer)

Findings12

Critical1

High4

Medium4

Low3

Analyzersstatic behavioral llm trigger meta

Second scanner: NVIDIA SkillSpector

VerdictCaution 0

Score0 / 100

Issues0

Version2.12.0 (static)

SkillSpector found no issues but could not fully inspect the package, usually because SKILL.md refers to a file that is not present, so it fails closed to CAUTION instead of SAFE. Read it as "not fully checked", not as a finding. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Autonomous crypto trading on Base via Bankr. Use for trading tokens, monitoring launches, executing strategies, or managing a trading portfolio. Triggers on "trade", "buy", "sell", "launch", "snipe", "profit", "PnL", "portfolio balance", or any crypto trading task on Base.

Package: 15 files, 37 KB
SKILL.md: 904 words, 12+ sections
Code: Shell (2)

SKILL.md covers: Base Trader 📈 · Philosophy · Prerequisites · Core Principles · 1. Risk Management (NON-NEGOTIABLE) · 2. Entry Criteria (ALL must pass) · 3. Exit Rules · Trading Strategies · Strategy 1: Launch Sniper (HIGH RISK) · Check trending/new tokens · Research before buying · Small entry

Findings

CRITICAL Hardcoded Credential Path Exposure Data Exfiltrationllm

The skill hardcodes the path to Bankr API credentials at ~/.clawdbot/skills/bankr/config.json and references this configuration file multiple times. This creates a risk of credential exposure if the skill or its logs are shared, and establishes a predictable target for credential theft.

SKILL.md:13

Bankr API configured at `~/.clawdbot/skills/bankr/config.json`

Remediation: Use environment variables or secure credential management systems instead of hardcoded file paths. Implement credential validation without exposing the storage location. Add warnings about protecting credential files.

HIGH External Tool Dependency Without Verification Unauthorized Tool Usellm

The skill depends entirely on an external 'bankr' tool located at ~/clawd/skills/bankr/scripts/bankr.sh with no verification of its integrity, authenticity, or behavior. All trading commands are passed directly to this external script, creating a tool poisoning risk where a compromised or malicious bankr tool could execute arbitrary actions.

scripts/check-portfolio.sh

BANKR_SCRIPT="$HOME/clawd/skills/bankr/scripts/bankr.sh"
if [ ! -f "$BANKR_SCRIPT" ]; then

Remediation: Implement cryptographic verification of the bankr tool (signature checking, hash validation). Add version pinning and integrity checks. Provide clear warnings about the external dependency and its security implications. Consider sandboxing or limiting the bankr tool's capabilities.

HIGH Command Injection via Unvalidated Trade Parameters Command Injectionllm

The log-trade.sh script accepts user-controlled parameters ($1-$6) and uses them directly in shell commands and JSON construction without validation or sanitization. Parameters like TOKEN, REASON, and TX could contain shell metacharacters or JSON injection payloads.

scripts/log-trade.sh

ACTION=$1
TOKEN=$2
AMOUNT_USD=$3
PRICE=$4
REASON=$5
TX=$6

Remediation: Implement strict input validation for all parameters. Use proper JSON escaping (jq --arg for safe variable interpolation). Validate that ACTION is one of allowed values (BUY/SELL). Sanitize TOKEN names against a whitelist pattern. Validate numeric inputs (AMOUNT_USD, PRICE).

HIGH Unbounded Automated Trading Without Circuit Breakers Resource Abusellm

The skill promotes automated trading strategies (DCA, limit orders, stop losses) but lacks implementation of the stated safety limits. The instructions mention 'MAX_DAILY_LOSS = -20%' and 'STOP TRADING FOR 24 HOURS' but provide no mechanism to enforce these limits, allowing unbounded automated execution that could drain funds.

SKILL.md

MAX_POSITION_SIZE = 10% of portfolio
MAX_SINGLE_TRADE = $50 USD
STOP_LOSS = -15% from entry
TAKE_PROFIT = +30% minimum target
MAX_DAILY_LOSS = -20% of starting balance

If daily loss limit hit → STOP TRADING FOR 24 HOURS.

Remediation: Implement actual enforcement mechanisms for stated limits. Add portfolio tracking to calculate daily P&L. Create a circuit breaker that prevents trading when limits are exceeded. Store state to persist limits across sessions. Add mandatory confirmation for trades approaching limits.

HIGH Deceptive Risk Framing and Gambling Promotion Social Engineeringllm

The skill presents high-risk cryptocurrency trading and 'launch sniping' (buying newly launched tokens) as systematic strategies, while acknowledging '90%+ of launches are rugs or scams' and '8 out of 10 snipes: Lose 50-100%'. The framing uses professional trading terminology to legitimize what is effectively gambling with extremely poor odds, potentially misleading users about the true risk.

references/launch-sniping.md

Expected Outcomes
- 8 out of 10 snipes: Lose 50-100%
- 1 out of 10 snipes: Break even or small profit
- 1 out of 10 snipes: 5-20x gain

Remediation: Add prominent warnings about the gambling nature of these activities. Clearly state expected value calculations showing negative returns. Require explicit user acknowledgment of risks before enabling trading features. Consider removing or heavily restricting 'launch sniping' functionality.

MEDIUM User input used in command substitution - potential injection risk Command Injectionstatic

Pattern detected: $(dirname "$0")

scripts/log-trade.sh:12

TRADES_FILE="$(dirname "$0")/../data/trades.json"

Remediation: Validate and sanitize all user inputs before using in commands

MEDIUM Sensitive Financial Data Logging Without Protection Data Exfiltrationllm

The skill logs all trades including amounts, tokens, reasons, and transaction hashes to data/trades.json without encryption or access controls. This creates a persistent record of financial activity that could be exposed through file system access, backups, or skill sharing.

scripts/log-trade.sh

TRADES_FILE="$(dirname "$0")/../data/trades.json"
...
TRADE=$(cat <<EOF
{
  "timestamp": "$TIMESTAMP",
  "action": "$ACTION",
  "token": "$TOKEN",
  "amount_usd": $AMOUNT_USD,
  "price": $PRICE,
  "reason": "$REASON",
  "tx": "$TX"
}
EOF
)

Remediation: Encrypt the trades.json file at rest. Implement access controls to restrict file permissions (chmod 600). Add options to disable logging or use ephemeral storage. Warn users that trade history is stored locally. Consider hashing or redacting sensitive fields.

MEDIUM Unsafe JSON Manipulation with jq Command Injectionllm

The log-trade.sh script uses jq to append trades to a JSON file, but constructs the JSON object using shell variable interpolation without proper escaping. While jq is used for the append operation, the initial JSON construction is vulnerable to injection if parameters contain special characters.

scripts/log-trade.sh

TRADE=$(cat <<EOF
{
  "timestamp": "$TIMESTAMP",
  "action": "$ACTION",
  "token": "$TOKEN",
  "amount_usd": $AMOUNT_USD,
  "price": $PRICE,
  "reason": "$REASON",
  "tx": "$TX"
}
EOF
)

Remediation: Use jq's --arg flag for safe variable interpolation: jq --arg action "$ACTION" --arg token "$TOKEN" --argjson amount "$AMOUNT_USD" '. += [{action: $action, token: $token, amount_usd: $amount, ...}]'. This ensures proper JSON escaping and prevents injection.

MEDIUM Transitive Trust in External Trading Commands Unauthorized Tool Usellm

The skill passes user-provided trading instructions directly to the external bankr.sh script without validation or sanitization. Instructions like 'Buy $X of TOKEN' are forwarded verbatim, creating a transitive trust issue where malicious input could exploit vulnerabilities in the bankr tool.

SKILL.md

~/clawd/skills/bankr/scripts/bankr.sh "Buy $25 of TOKEN on Base"
~/clawd/skills/bankr/scripts/bankr.sh "Set stop loss for TOKEN at -15%"

Remediation: Implement input validation before passing commands to bankr. Parse and validate trading parameters (amounts, token names, percentages). Use structured command formats rather than natural language strings. Add allowlists for valid tokens and command patterns.

LOW Skill does not specify a license Policy Violationstatic

Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

SKILL.md

Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

LOW Missing allowed-tools Declaration Data Exfiltrationllm

The skill does not declare an 'allowed-tools' field in its YAML manifest, making it unclear which agent capabilities it requires. Given that the skill executes bash scripts and potentially Python code (referenced but not found), this omission reduces transparency about the skill's permissions.

SKILL.md

allowed-tools: Not specified

Remediation: Add 'allowed-tools: [Bash, Read, Write]' to the YAML frontmatter to explicitly declare required capabilities. This improves transparency and allows users to make informed decisions about granting permissions.

LOW Missing License and Compatibility Information Social Engineeringllm

The skill lacks license and compatibility declarations in its manifest, reducing transparency about usage rights and supported environments. This is particularly important for a financial trading tool where legal and operational clarity is essential.

SKILL.md

license: Not specified
compatibility: Not specified

Remediation: Add 'license: MIT' (or appropriate license) and 'compatibility: Claude.ai, Claude Code, API' to the YAML frontmatter to clarify usage terms and supported platforms.

What is in the package

File	Kind	Size
`README.md`	doc	3.7 KB
`SKILL.md`	doc	6.5 KB
`data/performance.json`	config	232 B
`data/trades.json`	config	3 B
`references/automation-strategies.md`	doc	3.3 KB
`references/execution.md`	doc	2.6 KB
`references/launch-sniping.md`	doc	3.3 KB
`references/leverage-guide.md`	doc	3.4 KB
`references/market-analysis.md`	doc	2.3 KB
`references/market-research-bankr.md`	doc	2.5 KB
`references/risk-management.md`	doc	3.0 KB
`references/strategies.md`	doc	2.7 KB
`references/token-analysis.md`	doc	2.3 KB
`scripts/check-portfolio.sh`	script	300 B
`scripts/log-trade.sh`	script	767 B

External hosts referenced

github.com basescan.org

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

TOKEN

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://clawhub.ai/skills/base-trader
Raw scan result: base-trader-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/clawhub-ai-base-trader.svg)
Request a re-scan

Second scanner: NVIDIA SkillSpector

What this skill does

Findings

What is in the package

External hosts referenced

Environment variables referenced

What we checked

What we did not check

Sources

Related skills