Security audit

binance-trader

Security checks for vulnerabilities and agentic risk

Overview

This Binance trading guide is coherent, but it asks users to run an unpinned third-party MCP server and shows a plaintext HTTP bearer-token setup for a financial trading tool.

Review before installing. Prefer a pinned, reviewed version of the MCP server or a lockfile-based install, run it with a dedicated low-privilege account or container, keep Binance withdrawal permissions disabled, start on testnet, and use HTTPS or a private trusted network for any bearer-token remote setup.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:26
Finding: Unpinned Third-Party Package Is Automatically Downloaded and Executed
Content: View full analysis
Remediation: View remediation
"] ``` 2. Prefer installing through a project manifest and lockfile rather than resolving the package dynamically on every invocation. 3. Verify package provenance, publisher identity, signatures where available, and registry integrity hashes before deployment. 4. Disable or avoid automatic package execution from an untrusted or mutable registry in production. 5. Run the MCP server as a dedicated, unprivileged operating-system account or within a hardened container. 6. Restrict filesystem mounts, outbound network access, and inherited environment variables to the minimum required. 7. Use a Binance API key dedicated to this service with only necessary permissions. Do not enable withdrawal permissions. 8. Test and review each dependency upgrade before changing the pinned production version. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:47
Finding: Bearer Authentication Token May Be Transmitted over Plaintext HTTP
Content: View full analysis
:3100/mcp" } } } ``` ```json { "headers": { "Authorization": "Bearer " } } ``` ### Technical Analysis The remote-deployment example specifies an `http://` endpoint. The subsequent instructions recommend sending `MCP_HTTP_TOKEN` through the HTTP `Authorization` header as a bearer token. Plain HTTP provides neither transport encryption nor authenticated server identity. If this configuration is used across an untrusted network, an on-path attacker can observe the authorization header, capture the bearer token, modify MCP traffic, or impersonate the server. Because bearer tokens grant access based on possession, a captured token can generally be replayed without knowing another secret. Even when the service is initially deployed on a private network, plaintext transport remains unsafe if that network contains untrusted clients, compromised systems, insecure wireless segments, proxies, or routes outside the operator's control. ### Attack Path 1. An operator exposes the MCP server remotely and follows the documented `http://:3100/mcp` configuration. 2. The client sends `Authorization: Bearer ` over the plaintext connection. 3. An attacker with visibility or control over any network segment between the client and server captures the HTTP request. 4. The attacker extracts the bearer token from the authorization header. 5. The attacker replays the token against the exposed MCP endpoint before it expires or is rotated. 6. The attacker invokes any tools authorized by that MCP service. If Binance trading credentials and trading tools are enabled, this may include account queries or trading operations. An active on-path attacker could alternatively ...[truncated 801 chars]
Remediation: View remediation
" } } } } ``` 2. Require valid certificate verification and prohibit configurations that disable TLS validation. 3. Terminate TLS at a hardened reverse proxy if the MCP server does not support TLS directly. 4. Bind any plaintext backend listener to loopback or an isolated private interface that is inaccessible to untrusted clients. 5. Use short-lived, high-entropy tokens and provide a documented token-rotation and revocation procedure. 6. Restrict access using firewall rules, private networking, VPN access, or mutual TLS in addition to bearer authentication. 7. Never log authorization headers, and redact tokens from diagnostics and configuration exports. 8. Apply least privilege to the associated Binance API key and keep withdrawal permissions disabled. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description and the entire SKILL.md are written in Chinese, presenting the skill as Chinese-only guidance for AI assistants. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified, which is not stated here.
Content: No source excerpt is available for this finding.