Binance Web3

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 9:09 PM UTC
• Version: 1.0.0

Overview

This skill queries Web3 market endpoints with small shell scripts; it has documentation and validation gaps, but no evidence of credential theft, persistence, or destructive behavior.

Install only if you are comfortable with the skill sending token symbols, contract addresses, chain IDs, and any wallet addresses you provide to Binance Web3 or the K-line API host. Treat results as unauthenticated third-party API data, avoid supplying sensitive user-associated wallet addresses without intent, and prefer adding input validation and clearer documentation before broad use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: .

Finding

Unescaped User Input in JSON Request Bodies

Content

View full analysis

/dev/null ``` ### Technical Analysis Caller-controlled values are interpolated directly into JSON text without JSON escaping or input-format validation. Inputs containing quotation marks, commas, braces, or duplicate property names can terminate the intended string value and alter the structure of the request body. The values are enclosed in shell quotes, so this ...[truncated 1133 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: .

Finding

Unencoded User Input in URL Query Strings

Content

View full analysis

Remediation

View remediation

other

Note

• Location: scripts/address-info.sh:2

Finding

Undocumented Disclosure of User Wallet Addresses to a Remote Service

Content

View full analysis

[chainId] ADDRESS="${1}" CHAIN="${2:-56}" curl -s "https://web3.binance.com/bapi/defi/v1/wallet-direct/buw/wallet/token/balance" \ -H "Content-Type: application/json" \ -H "Accept-Encoding: identity" \ -d "{\"address\":\"$ADDRESS\",\"chainId\":\"$CHAIN\"}" | jq '.' ``` ### Technical Analysis The script transmits a user-provided blockchain address and chain identifier to Binance Web3. The project documentation describes token search, dynamic token data, K-line charts, and smart-money signals, but does not document the included wallet-address balance lookup or clearly disclose that wallet addresses are sent to a third party. Blockchain addresses are public identifiers, but associating an address with a particular request source, IP address, timestamp, or usage pattern may still reveal sensitive behavioral information. The script does not read local wallet files, private keys, seed phrases, or authentication tokens. ### Attack Path 1. A user supplies a wallet address for analysis, or an agent selects the included helper script. 2. The script places the wallet address and chain identifier into an HTTPS request body. 3. The request is transmitted to Binance Web3. 4. The remote service can observe the submitted wallet address together with normal request metadata. 5. Repeated requests may allow the service to correlate wallet interests or activity with the request origin. ### Impact Assessment The impact is limited to privacy and metadata exposure. The remote service receives a public blockchain address and chain identifier and may associate them with network metadata. The code does not grant access to wallet funds, private keys, local files, elevated privileges, or pers ...[truncated 24 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description focuses on market-oriented data such as token prices, market data, charting, and smart money signals. The supplied code does not query any of those; instead, it performs an address-specific wallet balance lookup using a wallet/token/balance endpoint. That is a materially different primary capability: address portfolio inspection rather than market analytics. Although it uses Binance Web3 APIs and a supported chain ID, the actual function is undeclared and not reasonably implied by the stated description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The description significantly overstates the implemented functionality. The supplied code only performs one concrete action: querying Binance Web3 smart money signals and formatting a subset of the response. It does not implement token search, token price lookup, market data retrieval, or K-line chart access. The declared chain coverage also mentions Base and Solana, but the script documentation and examples only identify BSC and Ethereum, with no evidence of explicit support for Base or Solana in this chunk. While using Binance Web3 APIs is consistent, the actual primary purpose is much narrower than described, so this is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The declared description focuses on price lookup, market data, charting, and smart money trading signals. However, the actual code only performs a token info/audit-style lookup against a governance token information endpoint. That is a materially different primary purpose from the described market and trading analytics functionality. While both concern tokens and Binance Web3 APIs, this code chunk does not demonstrate the declared capabilities and instead exposes an undeclared token audit/info retrieval capability.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises executable shell scripts in SKILL.md but does not declare any tool scope such as permissions or allowed-tools. This creates an execution-surface ambiguity where an agent may invoke shell capabilities without explicit least-privilege constraints, increasing the risk of unintended command execution or overly broad runtime access.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/address-info.sh (reported line 8)May include surrounding context.

sh

ADDRESS="${1}"
CHAIN="${2:-56}"

curl -s "https://web3.binance.com/bapi/defi/v1/wallet-direct/buw/wallet/token/balance" \
  -H "Content-Type: application/json" \
  -H "Accept-Encoding: identity" \
  -d "{\"address\":\"$ADDRESS\",\"chainId\":\"$CHAIN\"}" | jq '.'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script silently defaults to routing traffic through a proxy via HTTP_PROXY or a hardcoded local proxy without any user warning or consent. In a security-sensitive skill, proxy-mediated transmission can expose request metadata and API payloads to an intermediary, and the risk is elevated because the proxy is applied automatically rather than being an explicit opt-in behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/market-rank.sh (reported line 39)May include surrounding context.

sh

case "$TYPE" in
    smart-money)
        curl -s -x "$PROXY" \
            "https://web3.binance.com/bapi/defi/v1/public/wallet-direct/buw/wallet/web/signal/smart-money" \
            -H "Accept-Encoding: identity" \
            -H "Content-Type: application/json" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/token-audit.sh (reported line 8)May include surrounding context.

sh

SYMBOL="${1}"
CHAIN="${2:-56}"

curl -s "https://web3.binance.com/bapi/defi/v1/wallet-direct/buw/wallet/governance/token/info" \
  -H "Content-Type: application/json" \
  -H "Accept-Encoding: identity" \
  -d "{\"symbol\":\"$SYMBOL\",\"chainId\":\"$CHAIN\"}" | jq '.'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/trading-signal.sh (reported line 6)May include surrounding context.

sh

CHAINID="${1:-56}"

curl -s "https://web3.binance.com/bapi/defi/v1/public/wallet-direct/buw/wallet/web/signal/smart-money" \
  -H "Content-Type: application/json" \
  -H "Accept-Encoding: identity" \
  -d "{\"smartSignalType\":\"\",\"page\":1,\"pageSize\":20,\"chainId\":\"${CHAINID}\"}" | jq '.'

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This shell script performs an HTTP request to an external Binance endpoint and transmits the provided wallet address and chain ID, but the file contains no warning, confirmation, or user-facing notice about that disclosure. For code files, outbound network transmission of user data should have at least some visible disclosure unless clearly documented as part of the skill's stated purpose; the current comments only show usage, not the privacy-impacting behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The script performs an external HTTP request using curl and sends the chain ID and contract address to a remote Binance endpoint. There is no confirmation prompt, user-facing notice, or explanatory comment warning that input values will be transmitted over the network.

Content

No source excerpt is available for this finding.