T09 · Insecure Skill Coding Practices
Error
- Location
binance_agent/agent.py:63- Finding
Risk controls are declared but protective stop orders are never placed
- Content
View full analysis
- Remediation
View remediation
Security audit
Binance Trading Agent Openclaw
Security checks for vulnerabilities and agentic risk
Overview
This is a real automated leveraged-trading skill, but it lacks adequate live-trading guardrails and grants broader runtime authority than its purpose needs.
Install only if you are prepared to treat it as live trading software. Keep it on Binance Testnet or add a real dry-run gate, require explicit approval before orders or leverage changes, remove unrestricted shell access, use environment variables or a secret manager for API keys, and add enforced stop-loss and position-size limits before connecting production credentials.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
main.py:3- Finding
The documented dry run can submit live leveraged market orders
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:49- Finding
Third-party dependencies are installed without version or integrity constraints
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
openclaw.json:34- Finding
The agent is granted unrestricted shell capability beyond the declared workflow
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
README.md:54- Finding
Documentation encourages storing Binance credentials in tracked source code
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (20)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly supports opening and closing Binance Futures positions but does not prominently warn users that it can place real leveraged trades with financial loss risk. In an agent-driven context, omission of this warning is dangerous because operators may assume analysis-only behavior or overlook the transition from testnet to live trading, increasing the chance of unintended live order execution.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This method directly submits futures orders through the Binance API with no built-in confirmation, policy checks, dry-run mode, or guardrails around order type, size, or price inputs. In an agent skill context, this is dangerous because any upstream prompt injection, logic bug, or mistaken automation can trigger real, irreversible trading actions and financial loss.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This method changes futures leverage immediately without any user acknowledgment or validation of safe leverage bounds. In a trading agent, unauthorized or mistaken leverage increases can sharply amplify liquidation risk and losses, making this a safety-critical action that should not be exposed without guardrails.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest advertises automated futures trading without any visible warning about financial risk, account impact, or potentially irreversible actions. In a live-trading context, users may trigger leveraged trades, liquidations, or cascading losses without being clearly informed that the skill can take material financial actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill describes automated futures trade execution, leverage use, and live Binance interaction without an explicit warning that it can place real trades and cause financial loss. In this context, omission of a clear live-trading risk notice is dangerous because users may invoke the agent assuming analysis-only behavior, while the documented workflow includes autonomous order placement and position management.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README gives direct execution instructions for a Binance futures trading agent and only mentions testnet use as a recommendation elsewhere, not as a prominent warning at the execution step. Because this agent can place leveraged futures orders affecting real funds, users may run it against live accounts without fully appreciating that trades and losses can occur automatically.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs the agent to use abusive and profane language toward users ('say it's fucking reckless'), without any user opt-in or safety gating. This creates a predictable harassment/toxicity failure mode, increases the chance of policy violations, and is especially risky in a finance context where users may already be making high-stress decisions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document proposes an end-to-end agent that can generate signals and execute live Binance USDS Futures orders, but it provides no explicit warning about leveraged trading risk, liquidation, or unintended live-order placement. In the context of an agent skill, this omission can cause users to treat the design as operational guidance and deploy automation against real funds without adequate safety framing.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code includes Thai-only natural-language comments, docstrings, and log messages such as the startup, trade, and error outputs. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation because users are not given any locale choice or justification for the Thai-only behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The description 'An automated trading agent for Binance USDS-M Futures' is broad and does not define invocation boundaries, permissible actions, approval requirements, or risk controls. Ambiguous scope increases the chance the agent is used in unsafe contexts or allowed to act autonomously on high-risk financial operations beyond what a user intended.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest enables unrestricted shell execution for an automated trading agent, but the declared purpose only describes Binance futures trading and does not justify arbitrary OS command access. In this context, shell access expands the blast radius from financial actions to full host-level actions such as filesystem access, secret exfiltration, and execution of destructive commands if the agent is prompted, compromised, or misaligned.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill documentation predominantly uses Thai, which can impose a language requirement on users without explicit opt-in. The file does not indicate that the skill is intentionally region-specific or provide an alternative language option.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
All user-facing instructional content in this file is in Thai, and there is no indication that the skill supports language selection or is intentionally limited to Thai-speaking users for a documented reason. This can violate language or locale policy expectations when no opt-in or justification is provided.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The design references API key configuration and exchange trading parameters but does not warn about secure credential handling, least-privilege API scopes, or the danger of exposing keys in code, logs, or prompts. For a trading agent that can submit orders, compromised credentials could allow unauthorized trading or account misuse.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The inline comment is written in Thai and provides operational guidance about real-world configuration. This imposes a specific language for important instructions without any indication of user choice or multilingual support, which matches the locale/language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The comment explaining the safety-relevant testnet setting is only in Thai. Because this is operational guidance affecting environment behavior, presenting it in a single language without opt-in can violate language/locale policy expectations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This file includes user-facing natural-language docstrings and comments exclusively in Thai, which can indicate a fixed language/locale assumption. The policy for this audit flags language or locale constraints when no user choice or justification is provided, and there is no indication here that the skill is intentionally region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code contains user-facing natural-language comments/docstrings entirely in Thai, including the function descriptions at L08 and L43. Under the policy for natural-language violations, forcing a specific language without opt-in can be an issue when no alternative language choice or justification is provided.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The inline comments for both long and short signals state three criteria, including a MACD crossover, but the actual boolean expressions only check SMA crossover and RSI thresholds. This is an intent-code divergence because the documentation describes decision logic that the code does not implement.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This file contains natural-language comments and printed status messages only in Thai, which can impose a specific language on users without opt-in. The policy requires flagging language or locale constraints unless the skill offers a choice or clearly documents a justified regional limitation.
- Content