ClawHub
Back to skill

Security audit

Binance Spot OpenAPI Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about managing Binance Spot trading, but its setup uses a changeable remote API schema that can affect signed financial operations.

Install only if you are comfortable giving an agent access to Binance Spot account data and trading actions. Prefer testnet first, use read-only or narrowly permissioned API keys where possible, require explicit review before any mainnet write, and consider replacing the mutable schema URL with the bundled schema or a pinned, hash-verified copy.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:174
Finding

Mutable Remote OpenAPI Schema Controls Authenticated Financial API Operations

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:174-179; duplicated in references/usage-patterns.md:3-11
Vulnerability Type: Supply-chain risk caused by an unpinned remote schema
Risk Level: Medium

Vulnerable Code

SKILL.md:174-179:

bash
- `command -v binance-spot-mainnet-openapi-cli`
- If missing, create it:
  `uxc link binance-spot-mainnet-openapi-cli https://api.binance.com --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/binance-spot-openapi-skill/references/binance-spot.openapi.json`
- `command -v binance-spot-testnet-openapi-cli`
- If missing, create it:
  `uxc link binance-spot-testnet-openapi-cli https://testnet.binance.vision --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/binance-spot-openapi-skill/references/binance-spot.openapi.json`

references/usage-patterns.md:3-11:

bash
## Link Setup

```bash
command -v binance-spot-mainnet-openapi-cli
uxc link binance-spot-mainnet-openapi-cli https://api.binance.com \
  --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/binance-spot-openapi-skill/references/binance-spot.openapi.json

command -v binance-spot-testnet-openapi-cli
uxc link binance-spot-testnet-openapi-cli https://testnet.binance.vision \
  --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/binance-spot-openapi-skill/references/binance-spot.openapi.json

Technical Analysis

The link commands retrieve an OpenAPI schema from the mutable main branch of an external GitHub repository. They do not pin the schema to an immutable commit, verify a cryptographic digest, or use the audited schema bundled in references/binance-spot.openapi.json.

The schema controls the API operations, HTTP methods, paths, parameters, and security declarations exposed through the generated UXC links. Consequently, the effective API definition used at runtime can differ from the version ...[truncated 2308 chars]

Remediation
View remediation

Remediation Suggestions

  1. Use the schema bundled with the audited skill package instead of downloading a runtime copy from a mutable branch.
  2. If remote retrieval is required, replace the main URL with a raw GitHub URL pinned to a full immutable commit hash.
  3. Publish an expected SHA-256 digest and verify the downloaded file before passing it to UXC. Abort setup if verification fails.
  4. Validate that the schema contains only approved HTTPS Binance servers, /api/v3 paths, expected HTTP methods, and an explicit allowlist of operation IDs.
  5. Extend scripts/validate.sh to reject mutable branch URLs and verify any remote-schema commit and digest policy.
  6. Keep signer bindings restricted to the exact Binance host, HTTPS scheme, and /api/v3 prefix.
  7. Retain explicit user confirmation for every mainnet write and display the resolved host, method, path, symbol, side, quantity, and price before signing.
  8. Restrict Binance API keys to the minimum required permissions and configure Binance-supported IP allowlists where operationally possible.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.

md
- Curated OpenAPI schema: `references/binance-spot.openapi.json`

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

This endpoint cancels all open orders for a symbol, which is a destructive live trading action, yet the schema only presents it as a normal operation without any explicit hazard warning or confirmation requirement. In a skill designed to operate Binance APIs through an agent, this makes accidental invocation materially more dangerous because automated systems may treat it like a routine query rather than an irreversible action affecting active positions and execution strategy.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The live order creation endpoint can execute real trades with authenticated credentials, but the schema does not prominently warn that it is a financially consequential action on mainnet. In an agent skill, exposing trade execution as an ordinary API operation without strong warnings or guardrails raises the risk of unintended purchases/sales, misuse of linked credentials, and automated execution from ambiguous user prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The single-order cancellation endpoint performs a destructive action against live orders but lacks any explicit warning about operational or financial consequences. Because this skill targets account and order management, the missing warning is more dangerous than in a purely informational API: an agent may cancel a legitimate order due to misunderstanding, prompt injection elsewhere, or weak human review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The schema exposes authenticated account endpoints using an API key security scheme but provides no explicit warning that these operations access private account data and must be handled with extreme care. In an agent skill context, that omission increases the chance of accidental credential exposure, unsafe logging, or overly broad use of privileged endpoints by downstream tooling or users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation instructs users to place sensitive Binance API credentials and private key material into shell environment variables, including embedding the full PEM private key into an exported variable. Environment variables are commonly exposed through shell history, process listings in some contexts, debug output, crash reports, inherited subprocess environments, or CI logs, so this increases the chance of credential theft and unauthorized trading activity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.