Security audit

Binance Agentic Wallet

Security checks across malware telemetry and agentic risk

Overview

This wallet skill is coherent and not malicious, but it needs Review because it can affect real funds and tells the agent to modify the host environment with a global npm install/upgrade without a clear approval gate.

Install only if you trust the @binance/agentic-wallet npm package and the publisher. Before allowing any install, upgrade, transfer, trade, approval revoke, payment, prediction action, or DeFi transaction, review the exact command, recipient, chain, token address, amount, order IDs, fees, and whether the action can execute later or be irreversible.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill directs the agent to install additional skills from external GitHub sources at runtime, expanding capabilities beyond the declared wallet scope and introducing a supply-chain/trust-boundary risk. In a wallet-management context, this is particularly sensitive because installing new skills can indirectly enable code or instruction paths that influence financial operations or expose users to unreviewed tooling.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill instructs the agent to install or upgrade a global npm package as part of routine preflight behavior, which expands its capabilities beyond the stated wallet-operation scope and permits host system modification. In an agent setting, automatic package installation creates supply-chain and privilege risks, especially because it can fetch and execute code from an external registry without an explicit, security-focused approval step.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The file explains that limit orders execute automatically once a price condition is met, but it does not clearly warn the user at the action point that placing the order authorizes future real on-chain trading and fee incurrence without another confirmation at execution time. In a wallet skill handling live assets, this omission can mislead users into treating the action like a passive alert rather than a standing trade instruction, increasing the risk of unintended financial loss.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: `prediction trade cancel` is a state-changing operation that can alter or terminate the user's active market exposure, but the documentation does not require an explicit confirmation step before execution. In a wallet/trading skill, an agent could cancel open orders based on ambiguous user input or automation mistakes, causing financial loss, missed fills, or disruption of trading strategy.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: `prediction trade redeem` triggers an on-chain/state-changing payout claim, but the documentation does not instruct the agent to obtain explicit user approval before submitting the redemption. Even though redeeming winnings is usually beneficial, executing it without confirmation can trigger unintended transactions, fees, tax/accounting consequences, or claims on the wrong chain/token set in a highly sensitive wallet context.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The markdown directs automatic global npm installation or upgrade without warning that this changes the host environment and may execute untrusted package lifecycle scripts. In the context of a wallet skill, this is more dangerous because the same environment may handle sensitive credentials, transactions, or signing workflows, so an unnecessary system-modification step increases compromise impact.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This is a true safety vulnerability because the documentation instructs users how to transfer tokens, including using `--max`, without an upfront warning that the action is irreversible and can directly move or drain user funds. In a wallet skill that supports real on-chain operations, omission of a prominent asset-risk warning increases the chance of accidental loss, especially if a user misunderstands recipient selection, token choice, or the effect of sending the maximum balance.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.