Binance Dca Tool

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:09 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Binance DCA trading tool, but it needs Review because it can place real-money trades and has unsafe credential, endpoint, and argument-handling patterns.

Install only if you are comfortable giving an agent-assisted shell script access to Binance API credentials and potential live spot-buy authority. Use testnet first, restrict API keys to the minimum permissions with withdrawals disabled and IP allowlisting, avoid inline cron secrets, and do not run live buys or recurring schedules without explicit confirmation and spending limits.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/dca.sh:165

Finding

Arbitrary Python Code Execution Through Unvalidated DCA Plan Arguments

Content

View full analysis

= 0 else '' print(f' {pct:+4d}% -> avg \${avg:>10,.2f} -> {coins:.8f} BTC -> PnL: {sign}\${pnl:>10,.2f} ({sign}{pnl_pct:.1f}%)') " 2>/dev/null || die "Python3 required for plan calculations" ``` ### Technical Analysis The `amount`, `periods`, and `frequency` command-line arguments are interpolated directly into source code passed to `python3 -c`. The `plan` action does not validate these arguments before interpolation. Because each value is placed inside a single-quoted Python string literal, an attacker can supply a value containing a quote, terminate that literal, and append arbitrary Python statements. The shell constructs the resulting Python program before invoking the interpreter. For example, an argument shaped like the following demonstrates the injection primitive: ```text 1'); __import__('os').system('id'); # ``` This changes the generated statement into executable Python containing an attacker-controlled call to `os.system`. The vulnerability is not limited to shell commands; injected Python can directly read files, open network connec ...[truncated 1173 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/dca.sh:16

Finding

Unrestricted API Base URL Exposes Binance API Keys and Enables Server-Side Request Forgery

Content

View full analysis

/dev/null || die "API request failed: ${endpoint}" } api_signed() { local method="$1" endpoint="$2" query="${3:-}" check_keys local ts ts=$(timestamp) query="${query:+${query}&}recvWindow=${RECV_WINDOW}×tamp=${ts}" local sig sig=$(sign "$query") query="${query}&signature=${sig}" if [[ "$method" == "GET" ]]; then curl -sf -H "X-MBX-APIKEY: ${BINANCE_API_KEY}" \ "${BASE_URL}${endpoint}?${query}" 2>/dev/null || die "Signed API request failed: ${endpoint}" else curl -sf -X "$method" -H "X-MBX-APIKEY: ${BINANCE_API_KEY}" \ -d "$query" "${BASE_URL}${endpoint}" 2>/dev/null || die "Signed API request failed: ${endpoint}" fi } ``` ### Technical Analysis `BINANCE_BASE_URL` is accepted without validation and is used as the destination for both public and authenticated HTTP requests. The script does not enforce HTTPS, validate the hostname, restrict ports, or allow only documented Binance production and testnet origins. Authenticated requests include the Binance API key in the `X-MBX-APIKEY` header. They also disclose signed query data, timestamps, account-query parameters, and order parameters to the configured destination. Although the Binance secret key itself is not transmitted, an attacker-controlled server can capture the API key and signed request material. The same endpoint control can be used to make requests to loopback addresses, private network services, or cloud metadata endpoints. The request paths are determined by the script, which limits flexibility, but the destination host an ...[truncated 1402 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:65

Finding

Scheduling Guidance Encourages Persistent Plaintext Storage of Exchange Credentials

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill documents live market buys and automated scheduled trading without a prominent warning that these actions can immediately spend funds, incur fees, and create irreversible market exposure. Because the skill also suggests cron-based automation, the absence of strong risk and confirmation language materially increases the chance of accidental or repeated real-money trades.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill exposes shell-based operational capability but does not declare any tool scope or allowed-tools restrictions. In an agent environment, this can enable unintended command execution paths or broader-than-expected access, especially when the skill includes commands that can place live trades and handle API credentials.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger phrases are broad enough to match general financial-planning or accumulation discussions, which increases the chance that the agent invokes a live-trading skill when the user only wanted advice or analysis. In this context, overbroad routing is risky because the skill is capable of executing crypto purchases, not merely simulating them.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/dca.sh (reported line 55)May include surrounding context.

sh

curl -sf -H "X-MBX-APIKEY: ${BINANCE_API_KEY}" \
      "${BASE_URL}${endpoint}?${query}" 2>/dev/null || die "Signed API request failed: ${endpoint}"
  else
    curl -sf -X "$method" -H "X-MBX-APIKEY: ${BINANCE_API_KEY}" \
      -d "$query" "${BASE_URL}${endpoint}" 2>/dev/null || die "Signed API request failed: ${endpoint}"
  fi
}