Skill Trust Decision
Bitget Trader
Legitimate cryptocurrency trading automation for Bitget exchange with critically sensitive API credentials embedded in plaintext config files, representing significant credential theft risk if compromised.
Most direct threat evidence
Critical Credential Theft
Exposed API Credentials in Plaintext Real Bitget exchange API credentials (apiKey, secretKey, passphrase) are embedded in plaintext in config.json and multi_agent_config.json. These credentials enable spot trading and could be harvested for unauthorized trading or fund theft.
config.json:1 Why this conclusion was reached
2/4 dimensions flagged Block
Declared vs actual capability
2 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
10 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 3 attack-chain steps and 1 severe findings.
Pass
Dependencies and supply chain hygiene
Dependencies are present but no obvious high-risk issue stands out.
Attack Chain
01
Attacker gains read access to workspace directory
reconnaissance · config.json:1
02
Extracts plaintext API credentials from config.json or multi_agent_config.json
Impact · config.json:2
03
Uses harvested credentials to execute unauthorized trades on Bitget exchange
Impact · api.bitget.com
What drove the risk score up
Exposed API credentials in config files +25
Real Bitget API keys, secret keys, and passphrase embedded in plaintext in config.json and multi_agent_config.json
No declared credential handling policy +10
SKILL.md instructs users to save credentials but doesn't warn about security implications
Legitimate shell execution via child_process +5
execSync used in setup-cron.js and bitget-cli.js for running openclaw commands, documented but broad
Network access to legitimate API only +-5
All network requests go to api.bitget.com - no suspicious external connections
Most important evidence
Critical Credential Theft
Exposed API Credentials in Plaintext
Real Bitget exchange API credentials (apiKey, secretKey, passphrase) are embedded in plaintext in config.json and multi_agent_config.json. These credentials enable spot trading and could be harvested for unauthorized trading or fund theft.
config.json:1 Use environment variables (BITGET_API_KEY, BITGET_SECRET_KEY) instead of storing credentials in files. Add config.json to .gitignore immediately.
Medium Doc Mismatch
Network Capability Mismatch
SKILL.md declares network:READ but the scripts perform POST requests to place/cancel orders, representing WRITE operations on the exchange.
SKILL.md:1 Update SKILL.md to declare network:WRITE permission and document all trading capabilities
Medium Priv Escalation
Undeclared Shell Execution
setup-cron.js and bitget-cli.js use execSync to run openclaw CLI commands and spawn Node.js scripts. This shell:WRITE capability is not declared in SKILL.md.
setup-cron.js:28 Document shell execution requirements in SKILL.md if intentional, or refactor to use native Node.js APIs
Low Supply Chain
HttpsProxyAgent Dependency
Some scripts reference https-proxy-agent package for proxy support, but this external dependency is not declared in any requirements.txt or package.json.
rebalance.js:8 Create package.json to document all dependencies and versions
Declared capability vs actual capability
Filesystem Pass
Declared READ
→ Inferred READ
All scripts read config.json and grid_settings.json Network Block
Declared READ
→ Inferred WRITE
Places/cancels orders, not just reads data Shell Block
Declared NONE
→ Inferred WRITE
setup-cron.js:28, bitget-cli.js:89 use execSync Skill Invoke Pass
Declared NONE
→ Inferred READ
CLI dispatches to other scripts via execSync Suspicious artifacts and egress
Medium External URL
https://api.bitget.com/api/v2/spot/market/tickers?symbol=SOLUSDT GRID_STATUS_2026-03-17_2208.md:117
Medium External URL
https://www.bitget.com MANUAL_SETUP.md:26
Medium External URL
https://api.bitget.com MULTI_AGENT_SETUP_GUIDE.md:331
Medium External URL
https://www.google.com MULTI_AGENT_TEST_REPORT_2026-03-17.md:189
Medium External URL
https://www.investopedia.com/ QUANT_SYSTEM.md:233
Medium External URL
https://www.quantconnect.com/ QUANT_SYSTEM.md:234
Medium External URL
http://127.0.0.1:7897 README.md:242
Medium External URL
https://api.bitget.com$ dynamic-adjust-v2.js:14
Medium External URL
https://api.binance.com/api/v3/klines?symbol=$ dynamic-adjust.js:16
Medium External URL
https://api.binance.com/api/v3/ticker/price?symbol=$ dynamic-adjust.js:45
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| https-proxy-agent | unknown | implicit | No | Referenced in code but not in declared dependencies |
| Node.js built-ins | N/A | stdlib | No | fs, crypto, path, https, http, child_process |
File composition
137 files · 22340 lines
JavaScript 74 files · 13942 linesMarkdown 39 files · 7314 linesJSON 21 files · 1007 linesShell 3 files · 77 lines
Files of concern · 3
config.json Exposed API Credentials in Plaintext
dynamic-adjust-v2.js https://api.bitget.com$
dynamic-adjust.js https://api.binance.com/api/v3/klines?symbol=$ · https://api.binance.com/api/v3/ticker/price?symbol=$
Other files · smart-grid.js · multi_agent_controller.js · quant-trader.js · apply-scheme-a-final.js · deploy-highfreq-grids.js · trade-analyzer.js +3
Security positives
All network requests go to legitimate Bitget API (api.bitget.com)
No base64-encoded malicious code or obfuscation detected
No remote code execution via curl|bash patterns
No credential exfiltration to external servers
Proper HMAC-SHA256 API signing implemented correctly
No hidden backdoor functionality discovered
No evidence of C2 communication or data theft
No sensitive file access (.ssh, .aws, .env) beyond documented config paths