BNB Chain trading

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:06 AM UTC
• Version: 1.0.0

Overview

This DeFi trading skill looks purpose-built, but it advertises BNB Chain while enabling signed token orders across several EVM chains.

Review this skill before installing if you only want BNB Chain trading. Before any wallet approval or signature, confirm the exact chain, input token, maximum amount, spender/verifying contract, output recipient, deadline, and relay destination. Prefer exact per-order approvals and do not reuse the mock signatures or payloads from examples.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill metadata and name strongly imply BNB Chain-only behavior, but the instructions explicitly enable trading on multiple EVM chains. This mismatch can cause an agent or user to authorize actions on an unintended network, undermining scope restrictions, policy controls, and user consent around chain selection.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This template defines an EIP-712 signature payload that authorizes token movement via `TokenPermissions` and a fixed `spender`, but the template itself contains no embedded disclosure that the user is granting spend/transfer authority over their tokens. In the context of an agent trading skill, this is especially sensitive because signing can enable real asset movement under parameters the user may not fully understand, increasing phishing and consent risks even if the contract flow is intended for legitimate trading.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The file introduces token aliases and decimals for many non-BNB chains even though the skill is described as BNB Chain trading. In an agent setting, auxiliary addressbooks are often consumed as trusted configuration; this can cause chain-confusion, accidental routing to unsupported networks, or incorrect token selection if the agent or downstream tooling resolves symbols from this file without strictly enforcing the authoritative supported-chain list.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The file tells users to copy a nearby payload shape and replace fields, while showing fully formed signed-order examples and signature values without any warning not to reuse them verbatim. In a trading/signing workflow, this increases the chance that users or agents will copy unsafe examples, misunderstand which fields must be regenerated, or accidentally submit stale or invalid signatures as if they were real transaction artifacts.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill is explicitly described as BNB Chain trading, but the examples include payloads with chain IDs for Arbitrum (42161), Ethereum mainnet (1), and Base (8453). In a signing and relay context, mismatched chain examples can cause users or downstream agents to construct and sign orders for the wrong network, potentially leading to failed transactions, unintended approvals, or execution in an unexpected environment.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The file explicitly states that changing `output.recipient` away from `swapper` is dangerous, but it does not require a hard confirmation step, enforce a safe default at the UX boundary, or describe the concrete consequence: assets may be routed to an unintended recipient. In a non-custodial trading skill that builds signing payloads, this omission is materially risky because users or downstream agents may normalize or populate this field without realizing it can redirect proceeds.

External Transmission

Medium

• Category: Data Exfiltration

Content

'{order: $typed[0].message, signature: $sig, status: "pending"}' \
  > ./relay-payload.json

curl -fsS -X POST 'https://agents-sink.orbs.network/orders/new' \
  -H 'content-type: application/json' \
  --data @./relay-payload.json
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

status: "pending",
};

const response = await fetch("https://agents-sink.orbs.network/orders/new", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify(relayPayload),

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Low

• Confidence: 95% confidence
• Finding: The manifest says the skill is for 'Agent trading on BNB Chain' and lists 'Limit, DCA, stop-loss & take-profit.' The README describes a broader protocol supporting market swaps, TWAP, delayed-start, chunked recurring execution, and deployment across multiple EVM chains, so the documented behavior is wider than the manifest claims.

Vague Triggers

Low

• Confidence: 84% confidence
• Finding: This is a manifest file, so vague-trigger review applies. The description says only 'Use for gasless non-custodial EVM market, limit, TWAP, stop-loss, take-profit, delayed-start swaps,' which describes a general capability but gives no clear boundaries, explicit trigger phrases, or exclusion conditions, making invocation scope ambiguous.

Static analysis

No suspicious patterns detected.