AI News BNB Trader

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:34 AM UTC
• Version: 0.1.0

Overview

This is a coherent BSC trading bot skill, but it needs review because live mode can sign high-impact blockchain transactions with weak validation and some advertised safety controls are not reliably enforced.

Install only after careful review. Keep DRY_RUN=true until you have audited the transaction-building path, use a dedicated low-balance wallet, avoid broad token allowances, pin and validate external API origins, rotate any API key used with an untrusted ONEINCH_API_BASE, and do not rely on the panic command as a guaranteed stop for an already-running bot.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: src/dex/oneinch.ts:38

Finding

Arbitrary Remote Transaction Data Is Signed Without Validation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/dex/oneinch.ts:15

Finding

1inch API Credential Can Be Forwarded to an Arbitrary Host

Content

View full analysis

= { 'accept': 'application/json' }; if (this.apiKey) h['Authorization'] = `Bearer ${this.apiKey}`; return h; } async quote(from: string, to: string, amount: bigint): Promise { const url = `${this.base}/quote?src=${from}&dst=${to}&amount=${amount.toString()}`; const r = await fetch(url, { headers: this.headers() }); ``` The endpoint and credential are loaded independently from unrestricted environment variables: ```ts oneInchApiBase: s('ONEINCH_API_BASE', 'https://api.1inch.dev/swap/v6.0/56'), oneInchApiKey: s('ONEINCH_API_KEY'), ``` ### Technical Analysis The `Authorization` header containing `ONEINCH_API_KEY` is added to requests constructed from the configurable `ONEINCH_API_BASE`. No validation restricts the URL to HTTPS or to an approved 1inch hostname. Consequently, configuration injection or an unsafe deployment value can cause the bearer credential to be transmitted directly to an attacker-controlled server. There is also no explicit redirect policy ensuring that credential-bearing requests remain on an approved origin. ### Attack Path 1. The attacker gains influence over environment configuration or deployment parameters. 2. The attacker sets `ONEINCH_API_BASE` to an attacker-controlled HTTPS endpoint. 3. The bot performs a quote or swap request. 4. `headers()` attaches `Authorization: Bearer `. 5. The attacker-controlled server receives and records the API credential. 6. The attacker reuses the credential against the legitimate service, subject to the permissions and limits associated with that key. ### Impact Assessment The exposed credential can permit unauthorized use of the victim’s 1inch API account ...[truncated 406 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/dex/oneinch.ts:20

Finding

Documented Trading Safety Controls Are Ineffective or Not Enforced

Content

View full analysis

{ const url = `${this.base}/quote?src=${from}&dst=${to}&amount=${amount.toString()}`; const r = await fetch(url, { headers: this.headers() }); if (!r.ok) throw new Error(`quote failed ${r.status}`); const j = await r.json(); return { toTokenAmount: BigInt(j.dstAmount), estimatedGas: BigInt(j.gas ?? 0), slippageBps: 30 }; } ``` The risk gate then trusts that fixed value: ```ts const qt = await dex.quote(from, to, amountIn); const risk = riskCheck(store, { nowTs: Math.floor(Date.now()/1000), usdBalance: qBal, wbnbUsdValue: wBal * 600, orderUsd, estSlippageBps: qt.slippageBps, dailyPnlUsd: pnl, cooldownSeconds: config.cooldownSeconds, maxTradesPerDay: config.maxTradesPerDay, maxDailyLossUsd: config.maxDailyLossUsd, maxPositionPct: config.maxPositionPct, maxTradeUsd: config.maxTradeUsd, maxSlippageBps: config.maxSlippageBps }); ``` The panic command only updates the state file in the process executing that command: ```ts if (cmd === 'panic') { store.state.panic = true; store.save(); logger.warn('panic enabled'); return; } ``` The running trading loop retains its existing in-memory `store.state` and does not reload the file before performing subsequent trades. In addition, these configured controls are not used by the reviewed execution path: ```ts stopLossPct: n('STOP_LOSS_PCT', 0.03), takeProfitPct: n('TAKE_PROFIT_PCT', 0.05), ``` ### Technical Analysis The slippage check does not measure slippage. `slippageBps` is always set to 30 regardless of `dstAmount`, liquidity, market pric ...[truncated 1847 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (35)

Known Vulnerable Dependency: vitest==2.1.9 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

• Category: Supply Chain
• Confidence: 97% confidence

Finding

vitest 2.1.9 is a known vulnerable testing framework release with arbitrary file read and possible execution exposure when its UI server is running, plus the redirect-mock traversal issue. Even though it is a dev dependency, this is more concerning than typical tooling flaws because developer workstations and CI runners for a crypto-trading bot may contain wallet keys, RPC credentials, and exchange secrets that could be exposed if the vulnerable server is used.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vitest==2.1.9 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The file declares vitest with a caret range (^2.1.8), which can resolve to 2.1.9, a version identified by the scanner as affected by arbitrary file read / execution issues in Vitest UI and mocker handling. Although vitest is a devDependency and these issues generally require the test tooling to be installed and used in a vulnerable mode, compromise of developer or CI environments can still expose source, secrets, or enable code execution.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

bash

npm install
cp .env.example .env

配置

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented purpose centers on news-driven trading, but the skill also includes private key intake, encryption, and filesystem secret storage behavior that is far more sensitive than the description suggests. This mismatch can mislead users into providing wallet credentials without clearly understanding that the skill performs local key-management operations, materially increasing the risk around fund-bearing secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented purpose centers on news-driven trading, but the skill also includes private key intake, encryption, and filesystem secret storage behavior that is far more sensitive than the description suggests. This mismatch can mislead users into providing wallet credentials without clearly understanding that the skill performs local key-management operations, materially increasing the risk around fund-bearing secrets.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

nanoid 3.3.11 is flagged for multiple denial-of-service and integer handling issues that can cause hangs or unstable behavior with malformed size inputs or custom generators. Here it is only pulled in transitively through dev tooling, so it is less likely to affect the trading bot at runtime, but could still impact build or development services if attacker-controlled input reaches the generator paths.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.5.8 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

postcss 8.5.8 has multiple advisories including arbitrary file read and XSS-related issues in processing attacker-controlled content. Since it is present only via dev tooling in this project, risk to the deployed trading bot is reduced, but developers or CI systems processing untrusted styles or sourcemaps could still be exposed.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==5.4.21 — 3 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-53632 (launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows)

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

vite 5.4.21 is associated with path traversal and Windows-specific filesystem disclosure issues in development-server functionality. In this backend trading-bot context Vite is a dev dependency, so the vulnerable surface is not central to production trading operations, but developers running the tooling locally or in CI may still be at risk.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

ws 8.17.1 has advisories for memory disclosure and memory exhaustion DoS. Unlike many other findings, ws is a runtime dependency via ethers, so if the bot uses WebSocket RPC connections to BSC nodes, malformed or malicious peer traffic could potentially leak process memory contents or degrade availability; in a trading bot, availability and secret handling are both important.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This is a real safety-control failure. The bot persists panic and safeMode state, and even exposes a panic command, but the start() trading loop never checks either flag before evaluating signals and calling dex.swap(). In a live trading skill, users will reasonably rely on panic/safe mode as a hard stop; failure to enforce them can lead to continued autonomous trades during incidents, losses, or suspected compromise.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description and headings are written entirely in Chinese, which effectively imposes a language requirement on users. Under the policy criteria, locale or language constraints should either be optional for the user or clearly justified as region-specific; this file provides neither.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises capabilities that require environment access and outbound network access, but it does not declare any explicit tool scope or permission boundaries. For a trading bot that can read secrets and interact with external services, missing scope declarations increases the chance of unintended access, unsafe execution contexts, or user surprise about what the skill can do.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill discusses dry-run mode and trading commands but does not explicitly warn that disabling dry-run can trigger real on-chain transactions affecting user funds. In a financial trading context, omission of that warning is dangerous because users may underestimate the consequences of invoking commands or changing configuration, leading to irreversible asset loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill references key encryption but does not clearly warn users that private keys or equivalent wallet secrets are required for signing and may be stored as encrypted key material on disk. In the context of a blockchain trading tool, insufficient disclosure around credential handling materially increases the risk of unsafe secret entry, poor key hygiene, and compromise of funds.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file reads sensitive secret material from environment variables, including EVM_PRIVATE_KEY and KEY_PASSPHRASE. There is no confirmation prompt, logging, comment, or docstring in this file warning users that the skill accesses credential material.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/config.ts (reported line 38)May include surrounding context.

ts

quoteToken: s('QUOTE_TOKEN', 'USDT'),

  dexMode: s('DEX_MODE', 'oneinch'),
  oneInchApiBase: s('ONEINCH_API_BASE', 'https://api.1inch.dev/swap/v6.0/56'),
  oneInchApiKey: s('ONEINCH_API_KEY'),
  pancakeRouter: s('PANCAKE_ROUTER', '0x10ED43C718714eb63d5aA57B78B54704E256024E'),
  maxSlippageBps: n('MAX_SLIPPAGE_BPS', 50),

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The swap method performs a remote API call to build a swap and then submits an on-chain transaction via wallet.sendTransaction, which is a safety-critical and potentially irreversible operation. Aside from the dry-run log branch, there is no confirmation prompt, user-facing disclosure, or explanatory comment/docstring warning that real funds may be moved.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code retrieves a blockchain private key directly from configuration or decrypts it from disk, which is a sensitive credential operation. Although the behavior is technically necessary for the bot, this file provides no user-facing prompt, warning, or explanatory comment disclosing that secret key material will be accessed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The bot executes live token swaps and persists trade records, which is a safety-critical and potentially irreversible operation affecting user funds. While the code logs bot startup and supports dry-run mode, this file does not include a direct warning or explanatory comment that the start command can place real trades when dryRun is false.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/signals/openai-model.ts (reported line 11)May include surrounding context.

ts

const c = new AbortController();
    const t = setTimeout(() => c.abort(), this.timeoutMs);
    try {
      const r = await fetch('https://api.openai.com/v1/chat/completions', {
        method: 'POST',
        signal: c.signal,
        headers: {

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/signals/openai-model.ts (reported line 11)May include surrounding context.

ts

const c = new AbortController();
    const t = setTimeout(() => c.abort(), this.timeoutMs);
    try {
      const r = await fetch('https://api.openai.com/v1/chat/completions', {
        method: 'POST',
        signal: c.signal,
        headers: {

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code sends news.title and news.body to an external OpenAI API endpoint and uses an API key in the request, but there is no confirmation prompt, user-facing log, or explanatory comment/docstring in this file disclosing that data leaves the local system. For a code-file review under this rule, outbound transmission of user or system data without any visible warning qualifies as a missing user warning unless the warning is documented elsewhere.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This CLI prompts for a private key and passphrase, then immediately encrypts the key and writes the resulting secret material to disk without any explicit warning, confirmation, or guidance about secure file handling. In a wallet/trading skill context, users are handling high-value credentials, so silent persistence increases the chance of accidental exposure through backups, repo commits, shared machines, or weak filesystem permissions.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @vitest/mocker==2.1.9 — 1 advisory(ies): CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

@vitest/mocker 2.1.9 is a known vulnerable dev dependency with a path traversal / arbitrary file read issue in redirect-mock handling. Although it is primarily exercised in test or local development workflows rather than production runtime, it can expose local files if an attacker can influence mock configuration or a developer runs the vulnerable tooling on untrusted input.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: esbuild==0.27.3 — 1 advisory(ies): GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

esbuild 0.27.3 has a documented arbitrary file read issue tied to its development server on Windows. In this lockfile it appears as a dev dependency, so exposure is limited to development scenarios, but a vulnerable local dev server can still leak files from the developer machine.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.