Binance Event Contract Data Fetcher

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:58 AM UTC
• Version: 1.0.0

Overview

This skill is a market-data fetcher, but it asks to run automatically every minute indefinitely and uses an unpinned installer, so users should review it before installing.

Install only if you are comfortable with a skill that can make Binance API requests every minute in the background, cache data, and share it with related skills. Prefer a pinned installer version, explicit opt-in for the scheduled task, and documented commands to inspect, pause, and remove the auto-run behavior.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:41
• Finding: Unattended Scheduled-Task Persistence## Vulnerability Details **File Location**: `SKILL.md`, lines 41–43; corroborated by lines 4 and 99–100 **Vulnerability Type**: Scheduled-task persistence **Risk Level**: High **Vulnerable Instructions**: ```markdown ### 3.4 Running Rule - Auto-start cron task at Agent startup - Run at second 0 of every minute ``` Additional persistence instructions include: ```markdown - **Trigger Timing**: Auto-run every minute after Agent startup; also supports manual trigger via `/binance-fetch-data`; runs 24/7, aligned with Binance 7×24 trading hours ``` ```markdown ## Auto-Run Trigger 24/7, run every minute automatically after activation ``` ### Technical Analysis The Skill explicitly instructs the Agent to create or activate a cron-like recurring task at startup and execute it every minute indefinitely. This behavior persists beyond the original invocation and does not require approval for each subsequent execution. Although the stated purpose is market-data retrieval, a continuously scheduled operation exceeds the requirements of a purely on-demand data-fetching Skill. The project does not specify a bounded execution period, consent workflow, scheduler ownership, resource limits, or a disable and removal procedure. ### Attack Path 1. A user activates the Skill. 2. The Agent follows the instruction to configure a task that starts with the Agent. 3. The task invokes the Skill at second zero of every minute. 4. Each invocation performs external Binance requests, caching, and synchronization without additional user approval. 5. The recurring activity continues until the scheduler is separately identified and disabled. ### Impact Assessment The scheduled task obtains the ability to execute the Skill repeatedly under the Agent's existing privileges. Its scope includes persistent outbound network requests, local cache updates, and synchronization with related Skills. Potential consequences include ongoing resou ...[truncated 350 chars]
• Remediation: ## Remediation Suggestions - Remove automatic startup and cron configuration from the default behavior. - Require explicit, informed user consent before creating any scheduled task. - Display the exact schedule, command, working directory, network destinations, and execution identity before installation. - Prefer manual or session-scoped invocation unless persistence is essential. - If scheduling is required, use a bounded lifetime and conservative frequency rather than indefinite one-minute execution. - Add concurrency controls, request-rate limits, retry backoff, and resource limits. - Provide documented commands to inspect, disable, and completely remove the scheduled task. - Ensure deactivation or uninstallation removes all scheduler entries and cached state created by the Skill.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:94
• Finding: Execution of an Unpinned Mutable npm Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 94–96 **Vulnerability Type**: Unsafe third-party dependency installation and execution **Risk Level**: High **Vulnerable Instructions**: ```markdown ## Installation ```bash npx clawhub@latest install binance-event-contract-data-fetcher --dir /workspace/skills ``` ``` ### Technical Analysis The installation procedure uses `npx` with the mutable `@latest` tag. `npx` can download and execute package code from the configured npm registry, while `latest` can resolve to a different release at any future installation time. The instruction does not pin an audited version, verify a package integrity digest, use a lockfile, or require review of the retrieved package before execution. Consequently, the code executed during installation is not fully represented by the audited project. A compromised package maintainer, npm account, release pipeline, registry response, or newly published malicious version could alter the effective installer after this Skill has been reviewed. ### Attack Path 1. A user follows the documented installation command. 2. `npx` queries the configured npm registry for the package version currently identified by `clawhub@latest`. 3. The selected package is downloaded to the local environment. 4. `npx` executes the downloaded package with the privileges of the invoking user or Agent. 5. If the mutable release or its dependency chain has been compromised, attacker-controlled code executes before or during installation. 6. That code can access resources available to the installation process and can modify the target directory or other user-writable locations. ### Impact Assessment A compromised dependency could execute arbitrary code with the invoking user's privileges. Depending on the surrounding environment, this may permit reading user-accessible files and environment variables, making outbound network connections, modifying the `/worksp ...[truncated 309 chars]
• Remediation: ## Remediation Suggestions - Replace `@latest` with an exact, previously audited package version. - Verify the package archive against a trusted integrity digest or cryptographic signature before execution. - Use a lockfile and preserve registry-provided integrity metadata for the full dependency graph. - Download and inspect the package before running it rather than combining retrieval and execution through `npx`. - Restrict installation to a trusted registry and validate the expected package namespace and publisher. - Run installation in a sandbox with minimal filesystem access, no unnecessary credentials, and restricted outbound networking. - Review installation scripts and transitive dependencies before release. - Establish an update process that requires security review before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly auto-runs every minute, performs ongoing external network calls, caches the results, and syncs data to related skills, but it does not provide an explicit user warning or consent mechanism for this continuous behavior. In an agent environment, silent recurring network activity and cross-skill data sharing can violate operator expectations, increase attack surface, and cause privacy or policy issues even if the fetched data is market data rather than user secrets.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The installation command uses `npx clawhub@latest`, which pulls and executes the latest published package at runtime without pinning to a reviewed version. This creates a supply-chain risk: if the package is compromised or a malicious update is published, arbitrary code could run during installation with the agent's privileges.

Static analysis

No suspicious patterns detected.