币安撸毛助手 By：0x_WanG

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:27 AM UTC
• Version: 1.0.10

Overview

This skill coherently fetches public Binance and disclosed Alpha airdrop information and presents it in Chinese, with its network access, optional proxy/workspace settings, and report export behavior documented.

Install only if you want a Chinese-language Binance promotion and airdrop assistant. It contacts Binance and alpha123.uk, may honor your HTTP_PROXY setting, and may write Markdown reports under the configured OpenClaw workspace; verify financial opportunities on official pages before acting.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Tainted flow: 'PROXIES' from os.environ.get (line 15, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

params = {"type": "1", "pageNo": "1", "pageSize": "10", "catalogId": "93"}
headers = {"User-Agent": "Mozilla/5.0", "Accept": "application/json"}

resp = requests.get(url, params=params, headers=headers, timeout=15, proxies=PROXIES)
data = resp.json()
articles = data.get("data", {}).get("catalogs", [{}])[0].get("articles", [])

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'PROXIES' from os.environ.get (line 15, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

# 获取详情
    detail_url = "https://www.binance.com/bapi/composite/v1/public/cms/article/detail/query"
    detail_params = {"articleCode": code}
    detail_resp = requests.get(detail_url, params=detail_params, headers=headers, timeout=10, proxies=PROXIES)
    detail_data = detail_resp.json()
    
    body = detail_data.get("data", {}).get("body", "")

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'PROXIES' from os.environ.get (line 17, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

headers = {"User-Agent": "Mozilla/5.0", "Accept": "application/json"}
    
    try:
        resp = requests.get(url, params=params, headers=headers, timeout=10, proxies=PROXIES)
        if resp.status_code == 200:
            data = resp.json()
            body = data.get("data", {}).get("body", "")

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'PROXIES' from os.environ.get (line 17, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

headers = {"User-Agent": "Mozilla/5.0", "Accept": "application/json"}
    
    try:
        resp = requests.get(url, params=params, headers=headers, timeout=15, proxies=PROXIES)
        if resp.status_code == 200:
            data = resp.json()
            if data.get("code") == "000000":

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The usage section instructs users to invoke the skill with Chinese-only phrases such as “今日撸毛信息”, “理财产品”, “活动奖励”, and “空投预告”. This is a natural-language locale constraint presented as the expected interface, but the README does not offer alternative language options or explicitly document that the skill is intentionally Chinese-only.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The document states that it filters for non-Chinese-language-region activities, converts times to UTC+8, and uses Chinese name mappings, indicating a fixed Chinese locale behavior. There is no indication that users can choose another language or locale, nor a documented justification that this skill is intentionally limited to that region.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list includes generic phrases such as "赚钱活动", "撸毛信息", and especially the English phrase "airdrop info", which are broad enough to match common user intent outside a narrowly scoped skill invocation. The file also provides no exclusion conditions or negative examples to clarify when the skill should not activate.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises capabilities that involve environment variables, filesystem writes, and outbound network access, but it does not declare an explicit tool or permission scope. This weakens security review and runtime governance because operators and policy engines cannot easily constrain what the skill is allowed to do, increasing the chance of over-privileged execution or unnoticed data egress.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrase "赚钱活动" is broad and can match many general money-making or promotions-related requests that are unrelated to Binance. That can cause unintended invocation of a network-enabled skill, leading to user confusion, irrelevant responses, and unnecessary external requests under the wrong context.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrase "airdrop info" is generic and may activate for requests about unrelated crypto projects, security research, or general airdrop discussions. In this skill's context, accidental invocation is more concerning because the skill performs live network retrieval and may present Binance-focused results when the user intended another source or subject.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: Automatically filtering out non-Chinese-region activities without user opt-in can silently bias or suppress relevant information. While not a classic exploit primitive, it is a policy and safety issue because the skill may misrepresent available opportunities, create unfairness, or steer user decisions based on an undeclared locale assumption.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The module docstring and surrounding comments describe the skill as performing Chinese localization by default, with no indication that users can choose another language or opt in to this locale-specific behavior. The policy explicitly flags language or locale constraints when they are forced rather than optional or clearly justified as region-specific tooling.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This Python code sends network requests to external Binance endpoints and then prints retrieved content, but the file provides no user-facing warning, confirmation, or explicit disclosure beyond internal comments. For code files, outbound network activity should have some visible notice unless clearly documented as part of the skill's stated purpose, which is not evident here.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The module docstring and all user-facing output are written as a Chinese-only assistant for a specific audience, and the skill presents itself as '币安撸毛助手' without any indication that users may choose another language. This is a natural-language locale policy concern because the file hard-codes a language/locale experience rather than documenting opt-in or offering alternatives.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill’s stated purpose is Binance activity aggregation, but it also fetches and surfaces data from an unrelated third-party domain, alpha123.uk. This expands the trust boundary to an external source with no visible validation, making the output vulnerable to misinformation, supply-chain style content manipulation, or privacy/telemetry leakage through unsolicited outbound requests.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The module docstring and all user-facing output are written exclusively in Chinese, with no indication that the language is configurable or chosen by the user. This creates a natural-language policy concern if the environment expects language choice or user opt-in rather than a fixed locale.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The skill description says it displays Binance earning information, but the code also persistently writes a local report file. Undisclosed file writes create unnecessary side effects, can leak user activity or scraped data to disk, and violate least surprise for a read-oriented skill.

Tainted flow: 'output_file' from os.environ.get (line 242, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

output_file = os.path.join(workspace_base, ".binance_earning", "exports", "deadlines_verified.md")
    os.makedirs(os.path.dirname(output_file), exist_ok=True)
    
    with open(output_file, "w", encoding="utf-8") as f:
        f.write("# 币安活动截止日期核实报告\n\n")
        f.write(f"查询时间：{datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n\n")
        f.write(f"- ✅ 已核实截止日期的活动：{len(results_with_dates)} 个\n")

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: This markdown file is written entirely in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.

Context-Inappropriate Capability

Low

• Confidence: 83% confidence
• Finding: The manifest describes a user-facing assistant that displays Binance promotional and earning activity information. While network access to Binance is expected, reading process environment variables for proxy configuration adds an extra capability unrelated to the stated business purpose and can route requests through externally controlled infrastructure.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The code accesses the HTTP_PROXY environment variable and uses it for all HTTP and HTTPS requests, which can affect privacy and route traffic through sensitive infrastructure. There is no user-facing warning or explanatory disclosure about this environment-based behavior in the file.

Intent-Code Divergence

Low

• Confidence: 91% confidence
• Finding: The docstring says the function gets the latest Alpha airdrop data, suggesting general retrieval of current airdrop entries. In practice, the code just downloads a webpage and, if it sees 'KAT' or 'Katana', returns a hardcoded airdrop record with fixed points/time values, which contradicts the stated intent of fetching actual latest data.

Context-Inappropriate Capability

Low

• Confidence: 75% confidence
• Finding: The stated purpose is to provide Binance earning and promotional activity information. Reading HTTP proxy settings and a workspace base path from environment variables adds environment-sensitive behavior beyond the user-facing intent, especially since the manifest does not mention configuration, proxies, or filesystem export behavior.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The script writes a report file without warning the user near the operation or making persistence explicit in the skill behavior. Silent writes are risky because they create hidden state on disk and may expose derived data to other local processes or later users of the environment.

Static analysis

No suspicious patterns detected.