Binance Web3 API

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:06 AM UTC
• Version: 1.0.0

Overview

The skill is mostly scoped to public Binance Web3 research calls, but its setup loads a mutable remote API schema that can change after review.

Install only if you are comfortable with UXC creating a local command and making public Binance Web3 requests. Prefer using the bundled schema file or a commit-pinned schema URL, and avoid querying wallet addresses you do not want associated with Binance request logs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Mutable Remote OpenAPI Schema Creates a Supply-Chain Integrity Risk

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:14-15
• SKILL.md:39-42
• references/usage-patterns.md:5-7

Vulnerability Type: Unpinned remote dependency
Risk Level: Medium

Vulnerable Code

From SKILL.md:14-15:

markdown

- Access to the curated OpenAPI schema URL:
  - `https://raw.githubusercontent.com/holon-run/uxc/main/skills/binance-web3-openapi-skill/references/binance-web3.openapi.json`

From SKILL.md:39-42:

markdown

- `command -v binance-web3-openapi-cli`
- If missing, create it:
  `uxc link binance-web3-openapi-cli https://web3.binance.com --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/binance-web3-openapi-skill/references/binance-web3.openapi.json`
- `binance-web3-openapi-cli -h`

From references/usage-patterns.md:5-7:

bash

command -v binance-web3-openapi-cli
uxc link binance-web3-openapi-cli https://web3.binance.com \
  --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/binance-web3-openapi-skill/references/binance-web3.openapi.json

Technical Analysis

The documented setup directs UXC to load an OpenAPI schema from the mutable main branch of an external GitHub repository. The URL is neither pinned to an immutable commit nor protected by an integrity digest, even though an audited copy of the schema is included in the project.

An OpenAPI schema controls the operations, parameter placement, request bodies, and paths exposed through the generated CLI. Consequently, changes to the remote schema can modify effective request behavior after this Skill package has been reviewed. The configured Binance origin restricts the immediate destination of generated API requests, so the evidence does not establish arbitrary-domain code execution or credential exfiltration. Nevertheless, externally mutable schema content remains a supply-chain and request-integrity risk.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, ...[truncated 1609 chars]

Remediation

View remediation

Remediation Suggestions

1. Use the bundled references/binance-web3.openapi.json file as the default schema source so execution uses the exact artifact that was audited.
2. If remote retrieval is operationally required, replace the main branch URL with a URL pinned to an immutable Git commit.
3. Publish and verify a SHA-256 digest of the expected schema before linking or using it.
4. Fail closed when the integrity check fails; do not silently fall back to the mutable remote schema.
5. Restrict the accepted schema to the intended HTTPS server and an explicit allowlist of API paths and methods.
6. Add validation that rejects unexpected security schemes, external references, servers, callbacks, or operation-level destinations.
7. Update SKILL.md and references/usage-patterns.md so every example uses the pinned or local schema.
8. Add checks to scripts/validate.sh that reject schema URLs containing mutable references such as /main/ and confirm that any documented digest matches the bundled file.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The social hype leaderboard endpoint defines a required targetLanguage parameter but provides no documented user opt-in, supported-language choices, or regional justification. This can encode a language/locale constraint into the skill interface in a way that may force a specific language selection without clear policy justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.