Security audit
Security checks for vulnerabilities and agentic risk
This skill fetches live meme-token and topic rankings from Binance Web3 APIs without showing credential access, persistence, or destructive behavior.
Install only if you are comfortable with the agent making live requests to Binance Web3 for token and topic rankings. Treat the results as third-party market data, not financial advice, and verify token details before acting on them.
The skill advertises bonding-curve and migration-status support in a source-specific way, but the documented behavior appears limited to selecting ranked stages and calling Binance endpoints rather than performing direct launchpad analysis. This can create false confidence in the completeness or origin of the market intelligence returned to users.
The skill advertises bonding-curve and migration-status support in a source-specific way, but the documented behavior appears limited to selecting ranked stages and calling Binance endpoints rather than performing direct launchpad analysis. This can create false confidence in the completeness or origin of the market intelligence returned to users.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
*) SORT_VAL="$SORT" ;;
esac
RESPONSE="$(curl -s \
"https://web3.binance.com/bapi/defi/v2/public/wallet-direct/buw/wallet/market/token/social-rush/rank/list/ai?chainId=${CHAIN_ID}&rankType=${RANK_TYPE}&sort=${SORT_VAL}&asc=false" \
-H 'Accept-Encoding: identity' \
-H 'User-Agent: binance-web3/1.1 (Skill)')"
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
*) RANK_TYPE="$STAGE" ;;
esac
curl -s -X POST \
'https://web3.binance.com/bapi/defi/v1/public/wallet-direct/buw/wallet/market/token/pulse/rank/list/ai' \
-H 'Content-Type: application/json' \
-H 'Accept-Encoding: identity' \
The skill instructs the agent to run shell scripts (RUN_SKILL_SCRIPT ...) but does not declare any explicit tool scope or allowed-tools boundary. That makes external execution capability implicit rather than auditable, increasing the chance of overbroad script access, accidental misuse, or policy bypass when the skill is invoked.
The skill is described with broad trigger conditions such as 'market hot topics' and 'trending tokens,' which can cause unintended invocation in loosely related conversations. Unnecessary activation matters here because the skill performs external retrieval and potential shell execution, increasing exposure to data egress and tool misuse without strong user intent.
The skill explicitly instructs the agent to 'immediately run the script' and not merely show documentation, with no user-facing notice about external network access. This pressures the agent toward automatic external calls and script execution before consent or context validation, increasing the risk of silent data transmission and unintended tool use.
The skill performs external network transmission to a Binance endpoint to retrieve live token/topic data. External transmission is expected for this skill's purpose, but it still introduces security and privacy considerations because invocation may send request metadata off-platform and relies on a third-party service whose behavior and availability are outside local control.
curl -X POST 'https://web3.binance.com/bapi/defi/v1/public/wallet-direct/buw/wallet/market/token/pulse/rank/list/ai' \
-H 'Content-Type: application/json' \
-H 'Accept-Encoding: identity' \
-H 'User-Agent: binance-web3/1.1 (Skill)' \
The script’s actual behavior fetches Binance 'social-rush' market topics rather than meme-token data from Pump.fun, Four.meme, or similar launchpads as declared by the skill metadata. This capability mismatch is dangerous because it can mislead downstream users or agents into trusting output as launchpad-specific intelligence when it is actually sourced from a different platform and topic category.
The inline comments explicitly describe a 'Binance Topic Rush' fetcher, which contradicts the stated purpose of a meme-launchpad skill. Such contradictory documentation increases the risk of deceptive or confusing behavior, making it easier for hidden scope drift or supply-chain style misuse to go unnoticed during review.
The script transmits user-influenced parameters to an external third-party service (Binance), creating a data egress and supply-chain trust boundary. In this specific file the transmitted values are limited to chain/stage/limit and no secrets are present, so the risk is moderate rather than severe, but users may unknowingly rely on or disclose usage patterns to an undisclosed external provider.
*) RANK_TYPE="$STAGE" ;;
esac
curl -s -X POST \
'https://web3.binance.com/bapi/defi/v1/public/wallet-direct/buw/wallet/market/token/pulse/rank/list/ai' \
-H 'Content-Type: application/json' \
-H 'Accept-Encoding: identity' \
The manifest describes the skill as providing real-time meme token lists from Pump.fun, Four.meme, and other launchpads, which implies data collection from those ecosystems. This script instead queries a Binance Web3 endpoint for token pulse rankings, which is a materially different data source and behavior than the stated launchpad-focused scope.
The response schema specifies separate English and Chinese narrative fields, but the documentation labels only the English field as the AI narrative without offering guidance to honor user language preference. This can encourage a default English-only behavior despite the presence of multilingual data.
The inline documentation labels the script as a Binance-specific trending-token fetcher, while the skill's stated intent is a broader launchpad-oriented meme-token listing capability centered on Pump.fun, Four.meme, and similar sources. This documentation points users toward a different functional intent than the manifest communicates.
No suspicious patterns detected.