Security audit

Binance Pro

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real Binance trading helper, but it enables live trading and leveraged futures with weak scoping and credential guidance.

Review carefully before installing. Use a dedicated Binance API key with the minimum permissions needed, disable withdrawals, prefer read-only keys for account checks, use testnet where possible, restrict by IP if available, and require explicit confirmation before every trade, leverage change, or cancellation.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:15
Finding: Binance API Credentials Stored in an Unprotected Plaintext File
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill prominently advertises live spot/futures trading, leverage up to 125x, and order-management actions without an upfront warning that commands can place real orders and cause financial loss. Because the document includes copy-pastable order-placement examples, users may execute destructive live trades before encountering the later safety notes.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description is extremely broad ('any Binance operation') and paired with always-on metadata, which increases the chance the skill is auto-selected for a wide range of finance-related requests. In a live-trading context, overbroad activation can route benign balance or price queries into a capability set that also enables order placement and leverage changes, raising the risk of unintended sensitive actions.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
QUERY="timestamp=${TIMESTAMP}" SIGNATURE=$(echo -n "$QUERY" | openssl dgst -sha256 -hmac "$SECRET" | cut -d' ' -f2)

curl -s "https://api.binance.com/api/v3/account?${QUERY}&signature=${SIGNATURE}"
-H "X-MBX-APIKEY: ${API_KEY}" | jq '[.balances[] | select(.free != "0.00000000")]'

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
QUERY="timestamp=${TIMESTAMP}" SIGNATURE=$(echo -n "$QUERY" | openssl dgst -sha256 -hmac "$SECRET" | cut -d' ' -f2)

curl -s "https://api.binance.com/api/v3/account?${QUERY}&signature=${SIGNATURE}"
-H "X-MBX-APIKEY: ${API_KEY}" | jq '[.balances[] | select(.free != "0.00000000")]'

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: This command sends an authenticated POST to Binance to place a live market buy order, directly enabling asset purchases on a real account. In combination with the broad skill scope and lack of strong upfront live-trading warnings, this creates a significant risk of unintended or impulsive financial transactions.
Content: Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.
QUERY="symbol=${SYMBOL}&side=BUY&type=MARKET&quantity=${QUANTITY}&timestamp=${TIMESTAMP}" SIGNATURE=$(echo -n "$QUERY" | openssl dgst -sha256 -hmac "$SECRET" | cut -d' ' -f2)

curl -s -X POST "https://api.binance.com/api/v3/order?${QUERY}&signature=${SIGNATURE}"
-H "X-MBX-APIKEY: ${API_KEY}" | jq '.'

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: This command sends an authenticated POST to place a live market sell order, which can liquidate holdings immediately on the user's Binance account. Because the skill is positioned as a general-purpose assistant integration, exposing direct sell execution without stronger guardrails increases the chance of accidental or unsafe asset disposal.
Content: Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.
QUERY="symbol=${SYMBOL}&side=SELL&type=MARKET&quantity=${QUANTITY}&timestamp=${TIMESTAMP}" SIGNATURE=$(echo -n "$QUERY" | openssl dgst -sha256 -hmac "$SECRET" | cut -d' ' -f2)

curl -s -X POST "https://api.binance.com/api/v3/order?${QUERY}&signature=${SIGNATURE}"
-H "X-MBX-APIKEY: ${API_KEY}" | jq '.'

text

Static analysis

No suspicious patterns detected.