Binance Pro
v1.0.0Complete Binance integration - world's largest crypto exchange. Trade spot, futures with up to 125x leverage, staking, and portfolio management. Use to check balances, open/close positions, set stop loss and take profit, check PnL, and any Binance operation.
⭐ 13· 7.7k·50 current·52 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md contents match the stated purpose (Binance trading via REST endpoints using curl/jq), so the capability itself is coherent. However the registry metadata does not declare the obvious need for Binance credentials or the openssl binary that the instructions use. Declaring no required env vars/config paths while instructing users to save API keys to ~/.openclaw/credentials/binance.json is inconsistent and disproportionate.
Instruction Scope
Runtime instructions explicitly ask the agent/user to store API keys in a local file or set environment variables and show curl commands that can open/close positions. They only call Binance endpoints (api.binance.com / fapi.binance.com), which matches purpose, but they also rely on openssl (not declared). The instructions also contain inconsistent variable names (examples set BINANCE_API_KEY/BINANCE_SECRET but example commands use API_KEY/SECRET), which is an implementation/operational risk and could cause accidental misuse.
Install Mechanism
This is an instruction-only skill with no install spec or bundled code, which is the lower-risk option from an install-mechanism perspective (nothing downloaded or executed at install time).
Credentials
The registry claims no required credentials, yet the documentation requires an API key and secret (either in ~/.openclaw/credentials/binance.json or via env vars). That mismatch means the skill will need highly sensitive credentials to function but did not declare them as required; the user may not be warned by the registry. Storing secrets in plaintext under ~/.openclaw is also a sensitive action and should have been declared.
Persistence & Privilege
The skill is flagged always:true in metadata and registry flags, meaning it will be force-included for all agents. Combined with the ability to trade on Binance (and with agent autonomous invocation allowed), this creates a higher blast radius: a compromised or buggy agent could execute trades without an explicit install-time consent. The skill does not justify why it needs always:true.
What to consider before installing
Do not install (or supply live API keys) until these inconsistencies are resolved. Specific checks to request from the author: 1) Declare required credentials (exact env var names) and required binaries (openssl) in registry metadata; 2) Remove always:true or explain why the skill must be force-included for all agents; 3) Fix the example variable-name inconsistencies (BINANCE_API_KEY/BINANCE_SECRET vs API_KEY/SECRET) to avoid accidental exposure or misuse; 4) Prefer recommending API keys with limited permissions (read-only or restricted trading permissions) and IP restrictions, or use a dedicated account with minimal funds for automation; 5) Explain how credentials are stored/secured (avoid storing plaintext secrets if possible). If you proceed, create and use a Binance API key with the minimal permissions you need and be prepared to revoke it immediately if unexpected actions occur.Like a lobster shell, security has layers — review code before you run it.
latestvk97fcafsnqkymqpwh4jmm43w0d80d5bg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🟡 Clawdis
Binscurl, jq