Security audit
Security checks for vulnerabilities and agentic risk
This skill is a Binance Web3 market-ranking reference that makes disclosed public ranking queries and does not install code, persist, or access local data.
Install only if you want an agent to query Binance Web3 ranking endpoints and show crypto token and wallet leaderboard data. Treat the returned trader PnL and address analytics as third-party market data, not financial advice.
The invocation guidance is broad enough to trigger on generic market-chat requests, which can cause the agent to call this external skill more often than users expect. In context, that increases unnecessary third-party data retrieval and may surface wallet/trader leaderboard information in situations where a general conversational response would have sufficed.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST 'https://web3.binance.com/bapi/defi/v1/public/wallet-direct/buw/wallet/market/token/pulse/unified/rank/list' \
-H 'Content-Type: application/json' \
-H 'Accept-Encoding: identity' \
-d '{"rankType":10,"chainId":"1","period":50,"sortBy":70,"orderAsc":false,"page":1,"size":20}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST 'https://web3.binance.com/bapi/defi/v1/public/wallet-direct/tracker/wallet/token/inflow/rank/query' \
-H 'Content-Type: application/json' \
-H 'Accept-Encoding: identity' \
-d '{"chainId":"56","period":"24h","tagType":2}'
The skill exposes wallet-address leaderboard and trading performance data from external APIs without warning users that third-party data about addresses and PnL will be retrieved and presented. In this context, the issue is not code execution but privacy/transparency risk: users may not realize the skill profiles trader addresses and pulls potentially sensitive financial-performance metadata from Binance endpoints.
No suspicious patterns detected.