Security audit

Binance Spot

Security checks across malware telemetry and agentic risk

Overview

This Binance trading skill is mostly purpose-aligned, but it asks agents to handle live exchange credentials and store them in local files without enough safeguards.

Install only if you intentionally want an agent to interact with Binance Spot. Prefer testnet first, use a restricted API key with withdrawals disabled and IP allowlisting, avoid storing raw secrets in TOOLS.md, and require fresh explicit confirmation for every mainnet order, cancellation, or account-changing action.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill goes beyond making Binance Spot API requests and adds credential storage and account-management behavior, including persisting new API keys in TOOLS.md. Storing exchange credentials in skill-readable documentation creates a high-value secret repository that can be exposed to users, logs, other tools, or prompt injection, and is not necessary for simple request execution.

Context-Inappropriate Capability

Low

Confidence: 88% confidence
Finding: The skill explicitly instructs the agent to reveal fragments of stored API keys and secret keys back to users. Even partial secret disclosure increases the attack surface by enabling credential correlation, account enumeration, social engineering, and confirmation of which accounts and secrets are present.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The skill advertises authenticated trading and order-management endpoints, including order placement and cancellation, without a prominent upfront warning that these actions can execute real trades and change account state. In the context of a live exchange integration, this increases the risk of accidental destructive actions, especially because only mainnet transactions receive a later confirmation requirement.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill tells the agent to store newly provided Binance API credentials in TOOLS.md without warning about plaintext secret storage or downstream exposure. Persisting exchange credentials in documentation or workspace files is dangerous because those files may be readable by other tools, agents, users, backups, or logs, enabling account takeover and unauthorized trading.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation includes a concrete mainnet order-placement example against `https://api.binance.com/api/v3/order` without a prominent warning that it can execute real trades or that testnet should be used first. In an agent skill context, users may copy examples verbatim, so this increases the risk of unintended financial transactions and operational loss.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:295