ClawHub
Back to skill

Security audit

BinanceAlert

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Binance market alert tool that sends alerts to Telegram, with a notable but documented dependency on local Telegram credentials.

Before installing, use a dedicated Telegram bot token and chat ID for this skill, verify the target chat, and avoid putting unrelated secrets in the shared .secrets.env file if possible. Alert symbols, thresholds, notes, and timestamps may be sent to Telegram.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)

Hidden Instructions

High
Category
Prompt Injection
Content
---
name: binance-alert
description: Binance smart alert system. Monitors price/change alerts, new listings, Alpha airdrop opportunities, and HODLer announcements via Telegram. No Binance API Key required.
homepage: https://github.com/cnwpdb/binance-alert-skill
Confidence
60% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Credential Access

High
Category
Privilege Escalation
Content
| `TG_BOT_TOKEN` | Telegram Bot Token (from @BotFather) |
| `TG_CHAT_ID` | Telegram target Chat ID |

The script reads these from `/data/freqtrade/user_data/.secrets.env` automatically, or from system environment variables directly.

## Price Alert
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
| `TG_BOT_TOKEN` | Telegram Bot Token (from @BotFather) |
| `TG_CHAT_ID` | Telegram target Chat ID |

The script reads these from `/data/freqtrade/user_data/.secrets.env` automatically, or from system environment variables directly.

## Price Alert
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
#!/usr/bin/env python3
"""
BinanceAlert — openclaw 技能脚本
复用 /data/freqtrade/user_data/.secrets.env 中的 TG_BOT_TOKEN / TG_CHAT_ID
状态持久化到 /data/freqtrade/user_data/binance_alert_state.json

用法:
Confidence
96% confidence
Finding
The docstring reveals that the skill is designed to reuse credentials from a specific shared secrets file, indicating intentional credential access as part of normal operation. In an agent-skill setting, any capability that reads unrelated ambient secrets is more dangerous because it expands the skill's authority beyond its direct inputs and can enable unauthorized external messaging.

Credential Access

High
Category
Privilege Escalation
Content
from datetime import datetime

# ── 配置 ──────────────────────────────────────────────────────────────────────
ENV_FILE   = Path("/data/freqtrade/user_data/.secrets.env")
STATE_FILE = Path("/data/freqtrade/user_data/binance_alert_state.json")
BINANCE_API  = "https://api.binance.com"
BINANCE_WEB3 = "https://web3.binance.com"
Confidence
98% confidence
Finding
The hardcoded path to `.secrets.env` causes the script to read credentials from a shared location automatically, which is a true credential-access behavior rather than a harmless reference. In this context, that makes the skill more dangerous because an operator invoking a market-alert tool may not expect it to inherit and use preexisting secrets without explicit setup.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script explicitly reuses Telegram credentials from a shared secrets file and only mentions this in comments/docstrings, not through a runtime prompt or user-facing consent flow. In a skill context, silently consuming existing bot credentials can surprise the operator and cause data to be sent off-host using privileges the user did not realize this skill would access.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill transmits alert content to Telegram without any explicit user-facing warning at send time or setup time. Because messages may include monitored assets, notes, and timestamps, this creates an external data exfiltration path that may violate user expectations, especially since credentials are auto-loaded from disk.

External Transmission

Medium
Category
Data Exfiltration
Content
return
    try:
        http_post(
            f"https://api.telegram.org/bot{TG_TOKEN}/sendMessage",
            {"chat_id": TG_CHAT, "text": text, "parse_mode": "Markdown"}
        )
    except Exception as e:
Confidence
88% confidence
Finding
This code sends data to the Telegram Bot API, which is an external third-party service. While external transmission is core to the alerting feature, it is still security-relevant because monitored content and metadata leave the local environment and the transmission is powered by auto-discovered credentials.

Missing User Warnings

Low
Confidence
83% confidence
Finding
This markdown file documents access to `TG_BOT_TOKEN` and `TG_CHAT_ID` and states the script reads them from `/data/freqtrade/user_data/.secrets.env` or the system environment. It also states that monitored events are pushed via Telegram, but it does not clearly warn users about the privacy/security implications of transmitting alert content and using stored credentials.

Static analysis

No suspicious patterns detected.