Security audit

Binance Query Token Info

Security checks for vulnerabilities and agentic risk

Overview

This skill is a read-only token information lookup tool, with a limited data-exposure caveat around extra JSON parameters sent to its upstream APIs.

Install only if you are comfortable with token query parameters being sent to Binance Web3 endpoints and kline requests being sent to dquery.sintral.io. Do not include API keys, wallet secrets, private notes, or unrelated context in the JSON passed to the CLI.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/cli.mjs:24
Finding: Unrestricted CLI Parameters Are Forwarded to External Services
Content: View full analysis
Object.entries(p) .filter(([, v]) => v != null) .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`) .join('&'); ``` ```js const COMMANDS = { search: (p) => ({ url: `https://web3.binance.com/bapi/defi/v5/public/wallet-direct/buw/wallet/market/token/search/ai?${qs(p)}`, }), meta: (p) => ({ url: `https://web3.binance.com/bapi/defi/v1/public/wallet-direct/buw/wallet/dex/market/token/meta/info/ai?${qs(p)}`, }), dynamic: (p) => ({ url: `https://web3.binance.com/bapi/defi/v4/public/wallet-direct/buw/wallet/market/token/dynamic/info/ai?${qs(p)}`, }), kline: (p) => { // Translate unified interface → upstream kline field names. // { chainId, contractAddress, interval, ... } → { platform, address, interval, ... } const { chainId, contractAddress, ...rest } = p; const platform = chainId == null ? undefined : CHAIN_ID_TO_PLATFORM[chainId]; if (chainId != null && platform === undefined) { const supported = Object.keys(CHAIN_ID_TO_PLATFORM).map((k) => `"${k}"`).join(', '); throw Object.assign( new Error(`kline: unsupported chainId "${chainId}". Supported: ${supported}`), { exitCode: 1 }, ); } const upstream = { ...rest }; if (platform !== undefined) upstream.platform = platform; if (contractAddress !== undefined) upstream.address = contractAddress; return { url: `https://dquery.sintral.io/u-kline/v1/k-line/candles?${qs(upstream)}`, }; }, }; ``` ### Technical Analysis The CLI accepts an arbitrary JSON object and serializes every non-null property into an outbound URL query string. It does not enforce the documented parameter allowlists for any command. For `search`, `meta`, and `dynami ...[truncated 2694 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill invokes a Node.js CLI that performs network-backed token queries, but the manifest does not declare any explicit tool scope such as allowed tools or permissions. This creates an authorization gap: an agent runtime may grant broader-than-expected execution/network capability, making it harder to enforce least privilege and increasing the risk of unintended external requests or future abuse if the script behavior changes.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.