ClawHub
Back to skill

Security audit

币安撸毛助手 By：0x_WanG

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently fetches public Binance and disclosed Alpha airdrop information and presents it in Chinese, with its network access, optional proxy/workspace settings, and report export behavior documented.

Install only if you want a Chinese-language Binance promotion and airdrop assistant. It contacts Binance and alpha123.uk, may honor your HTTP_PROXY setting, and may write Markdown reports under the configured OpenClaw workspace; verify financial opportunities on official pages before acting.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (24)

Tainted flow: 'PROXIES' from os.environ.get (line 15, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · debug_dates.py (reported line 57)May include surrounding context.

python
params = {"type": "1", "pageNo": "1", "pageSize": "10", "catalogId": "93"}
headers = {"User-Agent": "Mozilla/5.0", "Accept": "application/json"}

resp = requests.get(url, params=params, headers=headers, timeout=15, proxies=PROXIES)
data = resp.json()
articles = data.get("data", {}).get("catalogs", [{}])[0].get("articles", [])

Tainted flow: 'PROXIES' from os.environ.get (line 15, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · debug_dates.py (reported line 74)May include surrounding context.

python
# 获取详情
    detail_url = "https://www.binance.com/bapi/composite/v1/public/cms/article/detail/query"
    detail_params = {"articleCode": code}
    detail_resp = requests.get(detail_url, params=detail_params, headers=headers, timeout=10, proxies=PROXIES)
    detail_data = detail_resp.json()
    
    body = detail_data.get("data", {}).get("body", "")

Tainted flow: 'PROXIES' from os.environ.get (line 17, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · verify_deadlines.py (reported line 56)May include surrounding context.

python
headers = {"User-Agent": "Mozilla/5.0", "Accept": "application/json"}
    
    try:
        resp = requests.get(url, params=params, headers=headers, timeout=10, proxies=PROXIES)
        if resp.status_code == 200:
            data = resp.json()
            body = data.get("data", {}).get("body", "")

Tainted flow: 'PROXIES' from os.environ.get (line 17, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · verify_deadlines.py (reported line 101)May include surrounding context.

python
headers = {"User-Agent": "Mozilla/5.0", "Accept": "application/json"}
    
    try:
        resp = requests.get(url, params=params, headers=headers, timeout=15, proxies=PROXIES)
        if resp.status_code == 200:
            data = resp.json()
            if data.get("code") == "000000":

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The usage section instructs users to invoke the skill with Chinese-only phrases such as “今日撸毛信息”, “理财产品”, “活动奖励”, and “空投预告”. This is a natural-language locale constraint presented as the expected interface, but the README does not offer alternative language options or explicitly document that the skill is intentionally Chinese-only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document states that it filters for non-Chinese-language-region activities, converts times to UTC+8, and uses Chinese name mappings, indicating a fixed Chinese locale behavior. There is no indication that users can choose another language or locale, nor a documented justification that this skill is intentionally limited to that region.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list includes generic phrases such as "赚钱活动", "撸毛信息", and especially the English phrase "airdrop info", which are broad enough to match common user intent outside a narrowly scoped skill invocation. The file also provides no exclusion conditions or negative examples to clarify when the skill should not activate.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill advertises capabilities that involve environment variables, filesystem writes, and outbound network access, but it does not declare an explicit tool or permission scope. This weakens security review and runtime governance because operators and policy engines cannot easily constrain what the skill is allowed to do, increasing the chance of over-privileged execution or unnoticed data egress.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger phrase "赚钱活动" is broad and can match many general money-making or promotions-related requests that are unrelated to Binance. That can cause unintended invocation of a network-enabled skill, leading to user confusion, irrelevant responses, and unnecessary external requests under the wrong context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The trigger phrase "airdrop info" is generic and may activate for requests about unrelated crypto projects, security research, or general airdrop discussions. In this skill's context, accidental invocation is more concerning because the skill performs live network retrieval and may present Binance-focused results when the user intended another source or subject.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Automatically filtering out non-Chinese-region activities without user opt-in can silently bias or suppress relevant information. While not a classic exploit primitive, it is a policy and safety issue because the skill may misrepresent available opportunities, create unfairness, or steer user decisions based on an undeclared locale assumption.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The module docstring and surrounding comments describe the skill as performing Chinese localization by default, with no indication that users can choose another language or opt in to this locale-specific behavior. The policy explicitly flags language or locale constraints when they are forced rather than optional or clearly justified as region-specific tooling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This Python code sends network requests to external Binance endpoints and then prints retrieved content, but the file provides no user-facing warning, confirmation, or explicit disclosure beyond internal comments. For code files, outbound network activity should have some visible notice unless clearly documented as part of the skill's stated purpose, which is not evident here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The module docstring and all user-facing output are written as a Chinese-only assistant for a specific audience, and the skill presents itself as '币安撸毛助手' without any indication that users may choose another language. This is a natural-language locale policy concern because the file hard-codes a language/locale experience rather than documenting opt-in or offering alternatives.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill’s stated purpose is Binance activity aggregation, but it also fetches and surfaces data from an unrelated third-party domain, alpha123.uk. This expands the trust boundary to an external source with no visible validation, making the output vulnerable to misinformation, supply-chain style content manipulation, or privacy/telemetry leakage through unsolicited outbound requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The module docstring and all user-facing output are written exclusively in Chinese, with no indication that the language is configurable or chosen by the user. This creates a natural-language policy concern if the environment expects language choice or user opt-in rather than a fixed locale.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill description says it displays Binance earning information, but the code also persistently writes a local report file. Undisclosed file writes create unnecessary side effects, can leak user activity or scraped data to disk, and violate least surprise for a read-oriented skill.

Content

No source excerpt is available for this finding.

Tainted flow: 'output_file' from os.environ.get (line 242, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · verify_deadlines.py (reported line 245)May include surrounding context.

python
output_file = os.path.join(workspace_base, ".binance_earning", "exports", "deadlines_verified.md")
    os.makedirs(os.path.dirname(output_file), exist_ok=True)
    
    with open(output_file, "w", encoding="utf-8") as f:
        f.write("# 币安活动截止日期核实报告\n\n")
        f.write(f"查询时间：{datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n\n")
        f.write(f"- ✅ 已核实截止日期的活动：{len(results_with_dates)} 个\n")

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown file is written entirely in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest describes a user-facing assistant that displays Binance promotional and earning activity information. While network access to Binance is expected, reading process environment variables for proxy configuration adds an extra capability unrelated to the stated business purpose and can route requests through externally controlled infrastructure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The code accesses the HTTP_PROXY environment variable and uses it for all HTTP and HTTPS requests, which can affect privacy and route traffic through sensitive infrastructure. There is no user-facing warning or explanatory disclosure about this environment-based behavior in the file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The docstring says the function gets the latest Alpha airdrop data, suggesting general retrieval of current airdrop entries. In practice, the code just downloads a webpage and, if it sees 'KAT' or 'Katana', returns a hardcoded airdrop record with fixed points/time values, which contradicts the stated intent of fetching actual latest data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The stated purpose is to provide Binance earning and promotional activity information. Reading HTTP proxy settings and a workspace base path from environment variables adds environment-sensitive behavior beyond the user-facing intent, especially since the manifest does not mention configuration, proxies, or filesystem export behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script writes a report file without warning the user near the operation or making persistence explicit in the skill behavior. Silent writes are risky because they create hidden state on disk and may expose derived data to other local processes or later users of the environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.