ClawHub
Back to skill

Security audit

Binance Crypto Market Rank

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed crypto-market ranking helper that calls fixed public Binance Web3 API endpoints and does not show hidden persistence, credential access, mutation, or exfiltration behavior.

Install only if you want an agent to fetch public Binance Web3 crypto leaderboard data. Use it for crypto/token/address ranking questions, and avoid passing private wallet notes, credentials, or unrelated personal data as command parameters.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill invokes a network-capable CLI but does not declare any explicit tool scope such as allowed tools or permissions. That creates an authorization gap where an agent may execute external network actions without clear policy boundaries, increasing the chance of unintended data exfiltration or unsafe API use.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger text is very broad: phrases like 'leaderboard' or 'rank by X' can match many generic user requests unrelated to this crypto-specific skill. Over-broad activation can cause the wrong skill to run, leading to unnecessary external calls, irrelevant financial outputs, and increased exposure to network-capable behavior in situations where it was not intended.

Natural-Language Policy Violations

Low
Confidence
82% confidence
Finding
The rules instruct the agent to interpret specific Chinese phrases such as "热门," "趋势," "火," "热搜," and "搜索榜" as routing signals. This embeds a language-specific policy in the skill behavior without stating that language handling is user-selectable or limited to an explicitly documented locale-specific use case.

Static analysis

No suspicious patterns detected.