Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Binance market alert tool that sends alerts to Telegram, with a notable but documented dependency on local Telegram credentials.
Before installing, use a dedicated Telegram bot token and chat ID for this skill, verify the target chat, and avoid putting unrelated secrets in the shared .secrets.env file if possible. Alert symbols, thresholds, notes, and timestamps may be sent to Telegram.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
---
name: binance-alert
description: Binance smart alert system. Monitors price/change alerts, new listings, Alpha airdrop opportunities, and HODLer announcements via Telegram. No Binance API Key required.
homepage: https://github.com/cnwpdb/binance-alert-skill
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
| `TG_BOT_TOKEN` | Telegram Bot Token (from @BotFather) |
| `TG_CHAT_ID` | Telegram target Chat ID |
The script reads these from `/data/freqtrade/user_data/.secrets.env` automatically, or from system environment variables directly.
## Price Alert
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
| `TG_BOT_TOKEN` | Telegram Bot Token (from @BotFather) |
| `TG_CHAT_ID` | Telegram target Chat ID |
The script reads these from `/data/freqtrade/user_data/.secrets.env` automatically, or from system environment variables directly.
## Price Alert
The docstring reveals that the skill is designed to reuse credentials from a specific shared secrets file, indicating intentional credential access as part of normal operation. In an agent-skill setting, any capability that reads unrelated ambient secrets is more dangerous because it expands the skill's authority beyond its direct inputs and can enable unauthorized external messaging.
#!/usr/bin/env python3
"""
BinanceAlert — openclaw 技能脚本
复用 /data/freqtrade/user_data/.secrets.env 中的 TG_BOT_TOKEN / TG_CHAT_ID
状态持久化到 /data/freqtrade/user_data/binance_alert_state.json
用法:
The hardcoded path to .secrets.env causes the script to read credentials from a shared location automatically, which is a true credential-access behavior rather than a harmless reference. In this context, that makes the skill more dangerous because an operator invoking a market-alert tool may not expect it to inherit and use preexisting secrets without explicit setup.
from datetime import datetime
# ── 配置 ──────────────────────────────────────────────────────────────────────
ENV_FILE = Path("/data/freqtrade/user_data/.secrets.env")
STATE_FILE = Path("/data/freqtrade/user_data/binance_alert_state.json")
BINANCE_API = "https://api.binance.com"
BINANCE_WEB3 = "https://web3.binance.com"
The script explicitly reuses Telegram credentials from a shared secrets file and only mentions this in comments/docstrings, not through a runtime prompt or user-facing consent flow. In a skill context, silently consuming existing bot credentials can surprise the operator and cause data to be sent off-host using privileges the user did not realize this skill would access.
The skill transmits alert content to Telegram without any explicit user-facing warning at send time or setup time. Because messages may include monitored assets, notes, and timestamps, this creates an external data exfiltration path that may violate user expectations, especially since credentials are auto-loaded from disk.
This code sends data to the Telegram Bot API, which is an external third-party service. While external transmission is core to the alerting feature, it is still security-relevant because monitored content and metadata leave the local environment and the transmission is powered by auto-discovered credentials.
return
try:
http_post(
f"https://api.telegram.org/bot{TG_TOKEN}/sendMessage",
{"chat_id": TG_CHAT, "text": text, "parse_mode": "Markdown"}
)
except Exception as e:
This markdown file documents access to TG_BOT_TOKEN and TG_CHAT_ID and states the script reads them from /data/freqtrade/user_data/.secrets.env or the system environment. It also states that monitored events are pushed via Telegram, but it does not clearly warn users about the privacy/security implications of transmitting alert content and using stored credentials.