Security audit

binance-trading

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a real Binance trading wrapper, but it can place live trades, change leverage, and close futures positions without documented confirmation or safety limits.

Review this carefully before installing. Use a dedicated least-privilege Binance API key, prefer read-only or testnet keys when possible, never hardcode secrets in source, restrict key permissions and IPs, and do not let an agent call the order, leverage, or close-position functions without a separate human confirmation process.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Ae1

High

Category: analysis-evasion
Content: const binance = require('./index.js');
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Missing User Warnings

High

Confidence: 98% confidence
Finding: The spot order function directly places live market or limit orders from caller-supplied parameters with no confirmation, preview, risk checks, or human approval step. In an agent environment, prompt confusion, tool misuse, or malicious instruction injection could trigger immediate real-money trades and irreversible financial loss.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly exposes live spot and futures trading operations, including placing orders, setting leverage, and closing positions, but provides no warning that these actions can trigger irreversible financial losses. In an agent context, documenting action-oriented trading functions without clear risk disclosure or confirmation guidance increases the chance of unsafe or unintended execution by users or downstream automation.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: This skill performs authenticated account access and live trading actions using Binance API credentials, but there is no visible manifest-scoped justification, capability restriction, or least-privilege boundary. In an agent setting, exposing balance reads, leverage changes, order placement, and position closing without explicit purpose/scope increases the risk of unauthorized financial actions and overbroad access to sensitive account data.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The request helper signs and sends authenticated requests containing account identifiers and trading actions to Binance using API credentials, but the code has no user-facing disclosure, logging, or explanatory docstring about external transmission of account data. Because this is a code file, authenticated network transmission should have some visible warning unless already clearly disclosed elsewhere, which is not present here.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: The natural-language instructions and descriptions are written in Chinese, but the file does not indicate that the skill is intentionally region- or locale-specific, nor does it offer language choice. This can violate a language/locale policy when users are not given an explicit opt-in or alternative.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The documentation instructs users to configure Binance API credentials via environment variables or directly in code, but gives no warning about secret handling, least privilege, or the danger of embedding keys in source files. This creates a realistic risk of credential leakage, especially if users hardcode secrets and later commit them to version control or expose them through logs.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: The code formats timestamps with toLocaleString() and does not offer the user any language or locale choice. That can produce locale-dependent output implicitly based on the runtime environment rather than explicit user preference.

Static analysis

No suspicious patterns detected.