Security audit

Binance API

Security checks for vulnerabilities and agentic risk

Overview

This Binance skill is mostly coherent, but it needs review because signed API examples can send Binance authentication material to any configured BINANCE_BASE_URL while the skill claims only official Binance endpoints are used.

Install only if you are comfortable giving the skill Binance account or trading API access. Use testnet first, prefer restricted API keys with withdrawals disabled and IP allowlisting, set BINANCE_BASE_URL only to a known Binance production or testnet host, avoid logging secrets or detailed account/order data, and pin or review SDK versions before installing them.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: auth-signing.md:24
Finding: Unvalidated API Base URL Can Disclose Binance Authentication Material
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: sdk-cli.md:14
Finding: Unpinned SDK Installation Commands Create Supply-Chain Exposure
Content: View full analysis
Remediation: View remediation
--hash=sha256: ``` Install it with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 5. For Node.js, specify an exact version, retain `package-lock.json`, and use `npm ci` for reproducible installation. 6. For Go, pin a reviewed module version and retain `go.mod` and `go.sum`. 7. For .NET, specify an exact package version and use a lockfile with locked restore mode. 8. Install and execute SDKs in an isolated, least-privileged environment. 9. Do not expose production Binance credentials during package installation or initial import testing. 10. Document a controlled upgrade process that reviews dependency changes and security advisories before changing pinned versions. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.
md
- Send data to undeclared services - Place production orders without explicit confirmation - Store API secrets in repository files - Modify this skill definition file ## Trust

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file includes concrete commands that read BINANCE_API_SECRET and later send BINANCE_API_KEY, but it does not warn users that these are sensitive credentials whose exposure could compromise their account. Under the markdown-specific warning criterion, credential-handling behaviour should be accompanied by an explicit caution about privacy or security impact.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · quickstart.md (reported line 45)May include surrounding context.
QS="symbol=BTCUSDT&side=$SIDE&type=$TYPE&timeInForce=$TIF&quantity=$QTY&price=$PRICE&timestamp=$TS" SIG=$(printf "%s" "$QS" | openssl dgst -sha256 -hmac "$BINANCE_API_SECRET" | sed 's/^.* //')

curl -s -X POST -H "X-MBX-APIKEY: $BINANCE_API_KEY"
"$BINANCE_BASE_URL/api/v3/order/test?$QS&signature=$SIG" -d ''

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The runbook logging advice lacks any warning about sensitive content, creating a real risk that users will store order details, account-related metadata, error traces, or even signing context in plaintext local notes. In a financial API skill, this context makes the issue more serious because seemingly harmless payload and response summaries can reveal trading strategies, balances, counterpart activity, or other private operational information.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · setup.md (reported line 32)May include surrounding context.
bash
mkdir -p ~/binance/snapshots touch ~/binance/{memory.md,runbooks.md,incidents.md} chmod 700 ~/binance ~/binance/snapshots chmod 600 ~/binance/{memory.md,runbooks.md,incidents.md}

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · setup.md (reported line 33)May include surrounding context.
mkdir -p ~/binance/snapshots touch ~/binance/{memory.md,runbooks.md,incidents.md} chmod 700 ~/binance ~/binance/snapshots chmod 600 ~/binance/{memory.md,runbooks.md,incidents.md}

text
5. If `memory.md` is empty, initialize it from `memory-template.md`.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · setup.md (reported line 54)May include surrounding context.
md
## Guardrails - Never ask the user to paste secrets into chat. - Never execute production trading flows without explicit confirmation. - Never present uncertain order status as final without reconciliation.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The guidance recommends logging Binance request payload and response summaries to a persistent file in the user's home directory, which creates unnecessary local retention of potentially sensitive operational data. Even if only 'summaries' are intended, API payloads, symbols, account actions, timestamps, order metadata, and error details can expose trading behavior or be expanded over time into more sensitive logging.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.