ClawHub
Back to skill

Security audit

Binance API

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only skill for fetching public Binance market data and does not request credentials, trading authority, persistence, or local data access.

Install this if you want Codex to use Binance public market-data endpoints for crypto lookups. Be aware it may choose Binance even when you ask a generic crypto price question, and it can make network requests or download public market-history files, but it does not provide trading/account access or require API keys.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
97% confidence
Finding
The description says to use the skill for "any crypto price lookup" and "crypto market analysis task, even if Binance isn't mentioned," which is a very broad activation condition for a manifest/markdown file. It does not provide limiting conditions or negative examples to clarify when the skill should not activate, increasing the chance of unintended invocation.

External Transmission

Medium
Category
Data Exfiltration
Content
than paging the REST API (a month of 1m klines = 1 file vs ~44 API calls).

Browse the archive interactively at:
`https://data.binance.vision/?prefix=data/spot/monthly/klines/BTCUSDT/`

Official reference: https://github.com/binance/binance-public-data
Confidence
15% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
"taker_buy_quote_volume", "ignore"]

def load_spot_klines_month(symbol: str, interval: str, month: str) -> pd.DataFrame:
    url = (f"https://data.binance.vision/data/spot/monthly/klines/"
           f"{symbol}/{interval}/{symbol}-{interval}-{month}.zip")
    df = pd.read_csv(url, header=None, names=KLINE_COLS)  # spot: no header
    ts = df["open_time"].where(df["open_time"] < 10**15, df["open_time"] // 1000)
Confidence
15% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.