Binance Pro Cn

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:11 PM UTC
• Version: 1.0.1

Overview

This Binance skill is purpose-aligned but needs Review because it exposes live account access and market-trading commands with broad triggers and weak safeguards.

Install only if you intentionally want a Binance trading assistant that can use API keys for live account reads and trade execution. Use a dedicated, least-privilege Binance API key, disable withdrawals, prefer testnet first, restrict source IPs where possible, protect credential files with restrictive permissions, and require explicit confirmation before every order, leverage change, or cancellation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:16

Finding

Plaintext Binance Credential Storage Without Access-Control Safeguards

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–27
Vulnerability Type: Plaintext sensitive credential storage and unsafe environment-variable handling
Risk Level: Medium

Vulnerable Code:

markdown

### Setup Credentials

Save to `~/.openclaw/credentials/binance.json`:
```json
{
  "apiKey": "YOUR_API_KEY",
  "secretKey": "YOUR_SECRET_KEY"
}

Environment Variables (alternative)

bash

export BINANCE_API_KEY="your_api_key"
export BINANCE_SECRET="your_secret_key"

text

### Technical Analysis

The Skill directs users to persist a Binance API key and secret in a plaintext JSON file but does not require restrictive permissions for either the credential directory or file. If default permissions, an existing permissive `umask`, backup tooling, or synchronization software make the file accessible to another local principal, the credentials may be disclosed.

The alternative approach exports credentials into the shell environment. Exported values are inherited by child processes launched from that shell, unnecessarily increasing the number of processes that can access the secret.

Authenticated examples elsewhere in the Skill use these credentials to sign Binance requests capable of reading private account data, placing spot and leveraged futures market orders, changing leverage, and cancelling orders. Credential access is necessary for the declared Binance integration, but the documented handling omits minimum safeguards appropriate for high-value financial credentials. No hardcoded real credential, withdrawal operation, credential exfiltration, or transmission to a non-Binance endpoint was identified.

### Attack Path

1. A user follows the setup instructions and creates `~/.openclaw/credentials/binance.json` without explicitly restricting its permissions, or exports the credentials from a shell that subsequently launches untrusted software.
2. A local process or user with acce
...[truncated 1312 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an operating-system keychain, dedicated secret manager, or OpenClaw-supported protected credential facility instead of a plaintext JSON file.
2. If file storage is unavoidable, document secure creation explicitly:

   bash

   install -d -m 700 "$HOME/.openclaw/credentials"
   umask 077
   install -m 600 /dev/null "$HOME/.openclaw/credentials/binance.json"
   

   Write the credential without placing it in shell history, then verify that the file remains owned by the intended user with mode 0600.
3. Avoid globally or persistently exporting secrets. Pass them only to the process that requires them, and prevent untrusted child processes from inheriting the values.
4. Create a dedicated Binance API key for this Skill and grant only the minimum required read or trading permissions. Disable withdrawals and any unused product permissions.
5. Apply Binance-supported source-IP restrictions and account security controls.
6. Use separate credentials for testnet and production, and recommend testnet validation before permitting live trades.
7. Never print credentials or signed request URLs in logs. Treat signed query strings as sensitive while valid.
8. Document credential rotation and immediate revocation procedures for suspected disclosure.
9. Require explicit user confirmation before every state-changing financial action, not only orders characterized as “large.”

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list includes very broad terms such as '交易' and 'trading', which can cause the skill to activate for generic finance or conversational requests rather than explicit Binance-specific intent. In a skill capable of querying balances and placing real spot/futures orders, accidental invocation materially increases the chance of unintended account access or live trade execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill markets high-risk capabilities including leverage, futures, staking, and trading without an immediate prominent warning that actions may execute against a live exchange account and can cause financial loss. Because the documented commands include market buy/sell and leveraged order placement, users may underestimate the risk and authorize dangerous actions without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

QUERY="timestamp=${TIMESTAMP}" SIGNATURE=$(echo -n "$QUERY" | openssl dgst -sha256 -hmac "$SECRET" | cut -d' ' -f2)

curl -s "https://api.binance.com/api/v3/account?${QUERY}&signature=${SIGNATURE}"
-H "X-MBX-APIKEY: ${API_KEY}" | jq '[.balances[] | select(.free != "0.00000000")]'

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

QUERY="timestamp=${TIMESTAMP}" SIGNATURE=$(echo -n "$QUERY" | openssl dgst -sha256 -hmac "$SECRET" | cut -d' ' -f2)

curl -s "https://api.binance.com/api/v3/account?${QUERY}&signature=${SIGNATURE}"
-H "X-MBX-APIKEY: ${API_KEY}" | jq '[.balances[] | select(.free != "0.00000000")]'

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This code performs a live authenticated POST to Binance's order endpoint to place a market buy order. In the context of broad triggers and limited upfront risk disclosure, exposing direct execution snippets for real-money trades substantially increases the risk of accidental, unauthorized, or insufficiently confirmed financial transactions.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

QUERY="symbol=${SYMBOL}&side=BUY&type=MARKET&quantity=${QUANTITY}&timestamp=${TIMESTAMP}" SIGNATURE=$(echo -n "$QUERY" | openssl dgst -sha256 -hmac "$SECRET" | cut -d' ' -f2)

curl -s -X POST "https://api.binance.com/api/v3/order?${QUERY}&signature=${SIGNATURE}"
-H "X-MBX-APIKEY: ${API_KEY}" | jq '.'

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This code performs a live authenticated POST to place a market sell order on a user's Binance account. Because market orders execute immediately and can liquidate holdings or close positions, exposing this as a routine skill action without strong gating, narrow invocation, and explicit live-trading consent creates serious financial risk.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

QUERY="symbol=${SYMBOL}&side=SELL&type=MARKET&quantity=${QUANTITY}&timestamp=${TIMESTAMP}" SIGNATURE=$(echo -n "$QUERY" | openssl dgst -sha256 -hmac "$SECRET" | cut -d' ' -f2)

curl -s -X POST "https://api.binance.com/api/v3/order?${QUERY}&signature=${SIGNATURE}"
-H "X-MBX-APIKEY: ${API_KEY}" | jq '.'

text

Static analysis

No suspicious patterns detected.