Binance Alpha Explorer

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:53 AM UTC
• Version: 1.0.6

Overview

This skill is a disclosed Binance listing monitor that uses public market APIs and local history files, with supply-chain and privacy caveats but no evidence of malicious behavior.

Install only if you are comfortable running a long-lived Binance market monitor that stores symbol baselines and alert history in your home directory. For better hygiene, use a virtual environment and pin websocket-client to a reviewed version before running it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:36

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:36
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code Snippet:

bash

pip3 install websocket-client --user

Technical Analysis

The documented installation command retrieves the latest version of websocket-client from the Python package index configured on the user's system without enforcing a reviewed version, package hash, or trusted index URL. Consequently, dependency resolution is non-reproducible, and the installed code may differ between installations performed at different times or in different environments.

Although no evidence indicates that the named package is currently malicious, this installation pattern creates a supply-chain exposure. A compromised upstream release, account takeover, malicious package-index configuration, or index substitution could cause attacker-controlled package code to be installed. The application subsequently imports the package from scripts/alpha.py, causing its module initialization code to execute.

Attack Path

1. An attacker compromises the upstream package or the package index used by the victim, or causes the victim's Python environment to resolve the package from an attacker-controlled index.
2. The attacker publishes or substitutes a malicious version of websocket-client.
3. A user follows the documented command in SKILL.md.
4. pip resolves the unpinned dependency to the malicious version and installs it into the user's package environment.
5. When scripts/alpha.py imports websocket, attacker-controlled initialization code executes with the privileges of the user running the monitor.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the account that installs or runs the Skill. The attacker could access files and credentials available to that account, alter application state, make network requests, ...[truncated 255 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin websocket-client to a specifically reviewed version in a dependency file rather than installing an unconstrained latest release.

2. Generate and verify cryptographic hashes for all dependency artifacts. For example, maintain a locked requirements file and install it with:

   bash

   python3 -m pip install --user --require-hashes -r requirements.txt
   

3. Configure the dependency file with an exact version and approved wheel or source-distribution hashes.

4. Explicitly use and document a trusted package index, and prevent fallback to untrusted or organization-internal indexes where dependency substitution is possible.

5. Periodically review and deliberately update the pinned version after checking release provenance, vulnerability advisories, and integrity hashes.

6. Prefer installation inside a dedicated virtual environment to reduce exposure of the user's broader Python environment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared behavior says the monitor keeps a known-symbol set in memory, but the documentation reveals additional persistent storage, extra CLI state-management commands, and REST API usage beyond the summarized purpose. This is dangerous because description-behavior mismatch undermines informed consent and trust: operators may approve a simple transient monitor while actually granting a tool that writes local state, retains history, and expands network interactions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill performs network access and local file read/write operations but does not declare any tool scope or permissions boundaries. This is dangerous because users and execution platforms cannot accurately assess or constrain what the skill is allowed to do, creating a transparency and least-privilege failure that can enable unexpected data persistence or outbound connections.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file presents all guidance, headings, and operational notes exclusively in Chinese. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/alpha.py (reported line 28)May include surrounding context.

python

# Binance 配置
BINANCE_WS_URL = "wss://stream.binance.com:9443/ws/!miniTicker@arr"
BINANCE_API_URL = "https://api.binance.com/api/v3"

# 存储文件
STATE_DIR = os.path.expanduser("~/.config/alpha")

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The implementation contradicts the stated behavior by persisting known symbols and alert history under ~/.config/alpha instead of keeping them only in memory. This is a real security/privacy issue because users and integrators may make trust decisions based on the manifest, and unexpected local persistence can expose monitoring history, trading interest, or operational metadata to other local users, backups, or forensic collection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language strings and descriptions that force a specific language for all prompts, help text, and operational output. Under the policy, locale or language constraints should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.