LLM Trading-Agent Security

Trading agents have a harsher threat model than normal LLM apps: an injection or a bad tool path turns directly into money lost. Layer independent controls — no single check is enough. (This drops the on-chain/MEV/wallet-signing parts of the original ECC skill and keeps what applies to centralized REST-API executors with your exchange/broker.)

1. Treat prompt injection as a financial attack ✅

Signal prompts ingest external data (news, social, market feeds, other-venue data). Sanitize anything that could carry an instruction before it enters an execution-capable prompt.

INJECTION = [r'ignore (previous|all) instructions', r'new (task|directive|instruction)',
             r'system prompt', r'(buy|sell|close|transfer|withdraw) .{0,40}(now|immediately|all)']
def sanitize_external(text: str) -> str:
    for p in INJECTION:
        if re.search(p, text, re.I): raise ValueError(f"possible injection: {text[:100]}")
    return text

Never blind-inject token names, headlines, webhooks, or social feeds into the decide prompt. Keep the decision schema strict (direction/size/levels) so free text can't become an order.

2. Hard spend / position limits (independent of model output) ✅

Enforce in code, separate from whatever the LLM says. Your existing risk gates and reduce-only SL+TP should be guards in code, not conventions.

MAX_SINGLE_NOTIONAL, MAX_DAILY_NOTIONAL = Decimal("15000"), Decimal("60000")
def check(amount):  # raise before any order submit
    if amount > MAX_SINGLE_NOTIONAL: raise SpendLimit(f"{amount} > single cap")
    if day_total() + amount > MAX_DAILY_NOTIONAL: raise SpendLimit("daily cap")

3. Validate before submit (the centralized analog of "simulate") ✅

Before sending an order: assert symbol is tradable, side/qty/price within sane bounds, leverage ≤ allowed, reduce_only set on SL/TP, and the computed notional matches the intended size (catch decimal/lot-size bugs). Reject on mismatch — never submit an order you didn't fully re-derive.

4. Circuit breakers / kill switch ✅

Halt on drawdown or invalid state. Formalize your existing risk gates and per-app pause flags:

MAX_CONSEC_LOSSES, MAX_HOURLY_LOSS = 3, 0.05
def guard(consec, portfolio, hour_start):
    if consec >= MAX_CONSEC_LOSSES: halt("consecutive losses")
    if hour_start <= 0: halt("invalid hour_start"); return
    if (portfolio - hour_start)/hour_start < -MAX_HOURLY_LOSS: halt("hourly drawdown")

Keep an env kill-switch (pattern: *_ENABLED=0 / ACTIVE_ASSETS=none) that stops generation+execution.

5. Key handling & audit ✅

Keys from env / your secret store, never in code or logs; the secret-scan hook backstops prompts. Use a dedicated trading key with least privilege. Audit-log every decision (including rejected/not-sent), not just successful orders — you can't debug or trust an executor whose refusals are invisible.

Pre-deploy checklist

• external data sanitized before the decide prompt - [ ] spend/position limits enforced in code, independent of model output - [ ] order re-derived & validated before submit (notional, lot size, reduce-only) - [ ] circuit breakers + env kill-switch wired - [ ] keys from env, never logged - [ ] every decision audit-logged (sent and not-sent) - [ ] paper-mode path tested before live.

Sources

Adapted from ECC skills/llm-trading-agent-security (MIT), re-scoped from on-chain wallets to centralized REST trading; aligns with reduce-only SL+TP, risk gates, kill-switch flags, and env-based secret handling.