Binance Stat Arb Monitor

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:26 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Binance market-monitoring and alerting tool, with notable safety and hygiene issues but no evidence of hidden malicious behavior.

Install only if you are comfortable with a Chinese-language trading monitor that writes local signal files and can send configured alerts to Telegram or Feishu. Keep notification tokens and webhooks private, restrict any cron log permissions, pin dependencies before production use, and review or fix the signal logic before acting on alerts with real money. Do not use the included Binance order API reference with live credentials unless you independently understand and intend the trade action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/notifier.py:27

Finding

Telegram Bot Token Exposure Through Exception Logging

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependencies Permit Unreviewed Future Releases

Content

View full analysis

=2.28.0 python-dateutil>=2.8.0 ``` ### Technical Analysis Both dependencies use lower-bound-only constraints. Each installation can therefore resolve to a different future package version that was not present during this audit. No lock file, exact version constraint, or package hash is provided. This weakens build reproducibility and expands supply-chain exposure. The package names are legitimate and there is no evidence of typosquatting or a currently malicious dependency; the risk arises from permitting arbitrary later releases without integrity verification. `python-dateutil` also appears unnecessary based on the audited executable scripts, which rely on the standard-library `datetime` module. Retaining an unused dependency increases the installation attack surface beyond the minimum required for the declared functionality. ### Attack Path 1. A future dependency version is compromised, maliciously maintained, or otherwise introduces exploitable behavior. 2. A user follows the documented command `pip install -r requirements.txt`. 3. Package resolution selects that unreviewed version because it satisfies the `>=` constraint. 4. The package is installed into the Skill's Python environment. 5. Malicious installation hooks or imported runtime code execute with the privileges of the user running the installation or Skill. ### Impact Assessment A compromised dependency can potentially execute Python code with the privileges of the installing or runtime account. This could expose files, configuration data, notification credentials, and network access available to that account. The practical severity is low because no malicious package or active compromise was identified. The finding represents avoidable supply-chain risk rather than evidence of an existing depe ...[truncated 18 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/calculator.py:37

Finding

Stop-Loss Logic Is Unreachable Because Entry Conditions Are Evaluated First

Content

View full analysis

entry_threshold: return "OPEN", "SHORT_ETH_LONG_BTC", f"z-score {zscore:.2f} above +{entry_threshold}, ETH relatively overvalued" # Take-profit condition if -exit_threshold < zscore < exit_threshold: return "CLOSE", "CLOSE_ALL", f"z-score {zscore:.2f} reverted to mean, close for profit" # Stop-loss conditions if zscore < -stop_loss: return "CLOSE", "CLOSE_ALL", f"z-score {zscore:.2f} reached stop-loss level" if zscore > stop_loss: return "CLOSE", "CLOSE_ALL", f"z-score {zscore:.2f} reached stop-loss level" ``` ### Technical Analysis The default configuration sets `entry_threshold` to `3.0` and `stop_loss` to `4.5`. Any z-score beyond either stop-loss boundary also satisfies the corresponding entry condition: - A z-score below `-4.5` is already below `-3.0`. - A z-score above `4.5` is already above `3.0`. Because the function returns immediately from the entry branches, both stop-loss branches are unreachable under the documented threshold relationship. Instead of generating a `CLOSE` recommendation during an extreme deviation, the code generates an `OPEN` recommendation. The code also has no position-state input, so it can recommend `CLOSE` when no position exists and repeatedly recommend `OPEN` without determining whether an equivalent position is already active. ### Attack Path 1. Market data, simulated data, or a configured Binance-compatible endpoint produces a z-score whose absolute value exceeds `4.5`. 2. `determine_signal()` evaluates the entry conditions before the stop-loss conditions. 3. The function returns `OPEN` immediately. 4. `monitor.py` saves the signa ...[truncated 912 chars]

Remediation

View remediation

= stop_loss: return "CLOSE", "CLOSE_ALL", f"z-score {zscore:.2f} reached stop-loss level" if zscore <= -entry_threshold: return "OPEN", "LONG_ETH_SHORT_BTC", "Entry threshold reached" if zscore >= entry_threshold: return "OPEN", "SHORT_ETH_LONG_BTC", "Entry threshold reached" ``` - Track whether a position is open, including its direction, before producing `OPEN`, `CLOSE`, or stop-loss recommendations. - Reject invalid threshold configurations unless `0 <= exit_threshold < entry_threshold < stop_loss`. - Define boundary behavior explicitly by using consistent inclusive or exclusive comparisons. - Add unit tests for values below, at, and above every positive and negative threshold. - Add integration tests confirming that values beyond the stop-loss boundary can never produce an `OPEN` signal. - Clearly label alerts as informational and require operator confirmation because the model does not execute or verify exchange positions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (20)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documentation describes capabilities that read and write local files and make outbound network requests, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent may be granted broader access than users expect, increasing the risk of unintended file access, data modification, or external exfiltration through notification endpoints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description is written entirely in Chinese and continues throughout the file with no indication that users may choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This JSON contains user-facing action fields in Chinese only ("观望", "无操作") with no indication that the skill is intentionally region-specific or that users can opt into this locale. That creates a natural-language locale policy issue because the file forces a specific language without documented justification or choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The reason value is natural-language content presented only in Chinese, but this file does not indicate any user opt-in to that language or a justified region-specific constraint. Under the policy, forcing a specific language in user-facing text is a reportable locale violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation includes a signed POST example to the production Binance Futures order endpoint, which is a real state-changing trading action, but it does not clearly warn users that running it against live credentials can place an actual order. In a trading-monitor skill, users may reasonably copy examples directly, so the lack of a safety warning materially increases the chance of accidental live trades and financial loss.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This Python file contains its module description, docstrings, and returned explanatory messages entirely in Chinese, including user-facing reason text such as trading signal explanations. Under the policy, language constraints should not be forced without user opt-in or a clearly documented locale-specific justification, and none is present in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code includes user-facing natural-language descriptions and log messages exclusively in Chinese, such as the module docstring and function documentation. The policy requires avoiding forced language or locale unless the skill offers user opt-in or clearly documents a justified regional constraint, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This Python file contains multiple user-facing strings and documentation in Chinese, including message output and module descriptions, without indicating that the user can choose a language or that the skill is region-specific. The policy requires flagging language or locale constraints when they are forced without user opt-in or clear justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code sends trading signal content to external services via Telegram and Feishu when enabled, which is a network transmission of potentially sensitive system or strategy data. While the script logs startup and results, it does not visibly disclose to the user that data will be transmitted to third-party services, and there is no confirmation prompt or explanatory comment/docstring near the sending logic.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code contains natural-language strings exclusively in Chinese, including the module description, function docstrings, warnings, and status messages. Under the stated policy, forcing a specific language without offering user choice or documenting a justified locale restriction is a policy violation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/notifier.py (reported line 27)May include surrounding context.

python

logger.warning("Telegram 配置不完整，跳过推送")
        return False
    
    url = f"https://api.telegram.org/bot{bot_token}/sendMessage"
    data = {
        "chat_id": chat_id,
        "text": message,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/notifier.py (reported line 35)May include surrounding context.

python

}
    
    try:
        response = requests.post(url, json=data, timeout=10)
        response.raise_for_status()
        result = response.json()

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

The code posts arbitrary message content to a configurable Feishu webhook URL with no validation or allowlisting. Because the destination is fully configuration-controlled, a malicious or compromised configuration could exfiltrate trading signals or other data to an attacker-controlled endpoint under the guise of notifications.

Content

Scanner excerpt · scripts/notifier.py (reported line 73)May include surrounding context.

python

}
    
    try:
        response = requests.post(webhook_url, json=data, timeout=10)
        response.raise_for_status()
        logger.info("✅ 飞书消息发送成功")
        return True

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This JSON file contains user-facing natural-language values in Chinese, including the recommendation actions and reason text. Because the file provides only one language and does not indicate user opt-in or a justified region-specific constraint, it appears to enforce a specific locale in a way that may violate language-choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The entire document is written in Chinese and does not indicate that the user can choose another language or that the content is intentionally limited to a Chinese-speaking audience. Under the policy, a fixed language or locale without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified with a lower bound only, so builds are not reproducible and may resolve to different versions over time. This increases supply-chain risk because the environment could install a vulnerable or breaking release of requests without review, which matters in a monitoring skill that makes outbound network calls.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.28.0
python-dateutil>=2.8.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The manifest references requests without pinning, and requests has multiple historical advisories; because the resolved version is unknown, the deployment may install an affected release. In this skill's context, requests is likely used for market data and Telegram/Feishu notifications, so an affected version could expose credentials or weaken request security depending on implementation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

python-dateutil is also unpinned, which makes installations non-deterministic and exposes the project to future vulnerable or incompatible releases. Even if this package is less security-sensitive than an HTTP client, unpinned dependencies still create avoidable supply-chain uncertainty.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.28.0
python-dateutil>=2.8.0

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

User-facing natural-language content in the module docstring and log messages is entirely in Chinese, and the file does not indicate that the skill is region-specific or provide any language selection. This can violate a language/locale policy when users are not given an explicit opt-in or alternative locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains user- and developer-facing natural-language text exclusively in Chinese, including the module description and function documentation. Under the policy rule, forcing a specific language without opt-in or justification is a locale/language policy issue, and no line indicates that Chinese is optional or required for a region-specific tool.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.