ClawHub
Back to skill

Security audit

moltrade

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it should go to Review because it handles live trading, exchange or wallet credentials, mutable installation sources, and public Binance Square posting with some under-specified safeguards.

Install only if you are comfortable reviewing the upstream Moltrade repository and dependencies yourself, using an isolated environment, least-privilege exchange keys, testnet or test mode first, and never pasting wallet private keys or broad trading keys into chat. Treat Binance Square posts as public and require a manual final review before publishing.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:50
Finding

Unpinned Third-Party Dependencies and Mutable Repository Installation

Content
View full analysis
Remediation
View remediation
``` 2. Publish and verify the expected commit SHA through a trusted release channel. 3. Pin every direct and transitive Python dependency to an exact version. 4. Generate a reviewed lockfile containing cryptographic hashes and install with: ```bash pip install --require-hashes -r requirements.lock ``` 5. Include the lockfile and dependency inventory in the Skill artifact so they can be audited. 6. Use an isolated virtual environment or container with minimal filesystem and network permissions. 7. Disable unnecessary package indexes and explicitly configure a trusted package source. 8. Add automated dependency scanning, provenance verification, and reproducible-build checks. 9. Test upgrades separately and require review before changing repository commits or dependency versions. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
binance/square-post/README.md:45
Finding

Contradictory and Undefined API Key Storage Guidance

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The documented skill behavior is for posting to Binance Square, while the declared skill metadata describes a Moltrade trading-bot operation skill. This scope mismatch is security-relevant because users or orchestration layers may grant permissions, trust, or invoke the skill under false assumptions, enabling unintended social-posting actions and API-key collection outside the stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation includes a concrete POST example against Binance mainnet that submits a MARKET BUY order, but it does not place an explicit warning immediately рядом to the example that running it can execute a real trade with live funds. In a trading-bot skill, users may copy-paste examples directly, so omission of a clear safety warning materially increases the chance of accidental financial loss.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · binance/spot/references/authentication.md (reported line 70)May include surrounding context.

Request:

bash
curl -X POST "https://api.binance.com/api/v3/order" \
  -H "X-MBX-APIKEY: your_api_key" \
  -H "User-Agent: binance-spot/1.0.1 (Skill)" \
  -d "symbol=BTCUSDT&side=BUY&type=MARKET&quantity=0.001&timestamp=1234567890123&signature=..."

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · binance/spot/references/authentication.md (reported line 70)May include surrounding context.

Request:

bash
curl -X POST "https://api.binance.com/api/v3/order" \
  -H "X-MBX-APIKEY: your_api_key" \
  -H "User-Agent: binance-spot/1.0.1 (Skill)" \
  -d "symbol=BTCUSDT&side=BUY&type=MARKET&quantity=0.001&timestamp=1234567890123&signature=..."

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The shell script is executable as written and demonstrates building a signed request that places a MARKET order on the live Binance endpoint. Because it lacks a nearby warning and defaults BASE_URL to mainnet, a user can unintentionally execute a real trade simply by filling in credentials and running the script.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

整个 README 以“.cn.md”形式提供且内容仅以中文指示使用方式，没有说明这是可选语言版本，也没有给出用户语言选择或 locale 适用范围。按照语言/地区策略，这可能构成默认强制特定语言而未取得用户选择。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger examples are broad natural-language phrases that overlap with ordinary conversation, which increases the chance of accidental activation. In a skill that can publish externally to Binance Square, mis-triggering can cause unintended public posts, reputation damage, or unreviewed disclosure of sensitive trading opinions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README explicitly says the user's Binance Square API key will be stored for future use, but it does not explain where it is stored, how it is protected, whether it is encrypted, how long it is retained, or how a user can revoke/delete it. In a trading-related skill, unclear credential retention is dangerous because an agent or operator may persist sensitive exchange-linked credentials in an unsafe location, increasing the risk of account misuse or unauthorized posting if the environment is compromised.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises broad auto-run triggers like 'post to square' and 'square post' without requiring strong confirmation or clear scoping. In an agent setting, this can cause unintended posting of user-provided or contextual text to an external public platform, especially if the trigger is matched loosely or inferred from conversation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill overview says only 'Post text content to Binance Square' and does not clearly warn that invoked content will be transmitted to a third-party external service and may become publicly visible. This increases the risk of users unknowingly disclosing sensitive, proprietary, or account-linked information through normal conversation with the agent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This skill is explicitly designed to transmit user content and an API credential to Binance over the network, so the external transmission is real and security-relevant in context. While the example itself is not malicious, the capability can expose sensitive text externally and should be treated as dangerous if invoked without informed consent, content review, and proper secret handling.

Content

Scanner excerpt · binance/square-post/SKILL.md (reported line 46)May include surrounding context.

Example Request

bash
curl -X POST 'https://www.binance.com/bapi/composite/v1/public/pgc/openApi/content/add' \
  -H 'X-Square-OpenAPI-Key: your_api_key' \
  -H 'Content-Type: application/json' \
  -H 'clienttype: binanceSkill' \

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · binance/spot/LICENSE.md (reported line 9)May include surrounding context.

md
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Static analysis

No suspicious patterns detected.