T09 · Insecure Skill Coding Practices
Error
- Location
scripts/bc.sh:53- Finding
Arbitrary Shell Execution Through Dotenv Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
Binance Coach
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly matches its Binance coaching purpose, but it has serious disclosure and implementation risks around secrets, persistent financial data, background tasks, and third-party AI data sharing.
Review carefully before installing. Use only read-only, IP-restricted Binance keys; check .env permissions; avoid enabling crons, watch-bg, Telegram, Anthropic coaching, or USER.md default handling unless you want those persistent behaviors. Treat AI coaching as sending portfolio and behavior details to Anthropic, and consider fixing the .env sourcing/eval/dependency issues before routine use.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (7)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup.sh:57- Finding
Credential File Is Written Without Safe Serialization or Explicit Permissions
- Content
View full analysis
/dev/null; then sed -i '' "s|^${key}=.*|${key}=${val}|" "$ENV_FILE" else echo "${key}=${val}" >> "$ENV_FILE" fi } ``` ```bash BINANCE_KEY="$(prompt_key "Binance API Key")" BINANCE_SECRET="$(prompt_key "Binance API Secret")" set_env "BINANCE_API_KEY" "$BINANCE_KEY" set_env "BINANCE_API_SECRET" "$BINANCE_SECRET" ``` ### Technical Analysis The setup process creates the credential file with `touch` and does not explicitly set mode `0600` or establish a restrictive `umask`. Its effective permissions therefore depend on the caller’s environment. Values are interpolated directly into a `sed` expression or appended through `echo` without robust dotenv serialization. Characters meaningful to `sed`, newlines, and shell syntax are not safely encoded. This is particularly dangerous in combination with the separate use of `source` to load `.env`: a malformed or crafted value written as configuration can later become executable shell content. ### Attack Path 1. Setup runs under a permissive umask, or an existing `.env` has overly broad permissions. 2. Binance, Anthropic, and Telegram credentials are written to that file. 3. Another local account or process with access to the file reads those credentials. 4. Alternatively, a crafted value containing delimiters, newlines, or shell syntax is supplied during setup. 5. The value corrupts the dotenv structure and is later executed when another script shell-sources the file. ### Impact Assessment The confidentiality impact ...[truncated 349 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/daily-analysis.sh:34- Finding
Remote-Influenced Analysis Output Is Executed With eval
- Content
View full analysis
&1) || true FG_RAW=$($BC fg 2>&1) || true DCA_RAW=$($BC dca 2>&1) || true # Parse everything with Python (avoids macOS grep -P issue) PARSED=$($PYTHON - "$PORTFOLIO" "$FG_RAW" "$DCA_RAW" << 'PYEOF' import sys, re portfolio = sys.argv[1] fg_raw = sys.argv[2] dca_raw = sys.argv[3] totals = re.findall(r'\$([0-9,]+\.[0-9]+)', portfolio) total = totals[-1].replace(',','') if totals else '0' health = re.search(r'Health:\s*(\d+)', portfolio) grade = re.search(r'Grade:\s*(\w+)', portfolio) fg_score = re.search(r'Score:\s*(\d+)', fg_raw) fg_label = re.search(r'Status:\s*([^\n│]+)', fg_raw) print(f"TOTAL={total}") print(f"HEALTH={health.group(1) if health else '?'}") print(f"GRADE={grade.group(1) if grade else '?'}") print(f"FG_SCORE={fg_score.group(1) if fg_score else '50'}") print(f"FG_LABEL={fg_label.group(1).strip() if fg_label else 'Unknown'}") print(f"SHIB_RSI={get_rsi('SHIB')}") print(f"SHIB_MULT={get_mult('SHIB')}") print(f"ANKR_MULT={get_mult('ANKR')}") print(f"DOGE_RSI={get_rsi('DOGE')}") print(f"DOGE_MULT={get_mult('DOGE')}") print(f"ADA_RSI={get_rsi('ADA')}") print(f"ADA_MULT={get_mult('ADA')}") print(f"BTC_MULT={get_mult('BTC')}") PYEOF ) || true # Load parsed vars eval "$PARSED" ``` ### Technical Analysis The shell captures command output containing data obtained from Binance and market-data services, parses it into assignment-like strings, and passes the result to `eval`. At least `FG_LABEL` is emitted without shell quoting. If a malicious or compromised upstream response, altered local command, or manipulated output introduces shell metacharacters into a parsed field, `eval` interprets them as shell syntax rather than data. Using Python for parsing does not create a security boundary ...[truncated 905 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
src/requirements.txt:1- Finding
Unpinned Dependencies Are Installed Into the System Python Environment
- Content
View full analysis
=3.7.0 pandas>=2.0.0 anthropic>=0.20.0 python-telegram-bot>=20.0 python-dotenv>=1.0.0 rich>=13.0.0 requests>=2.31.0 aiohttp>=3.9.0 ``` ```bash echo "" echo "📦 Installing Python dependencies..." if pip3 install --break-system-packages -q -r "$INSTALL_DIR/requirements.txt" 2>/dev/null || \ pip3 install -q -r "$INSTALL_DIR/requirements.txt" 2>/dev/null || \ python3 -m pip install -q -r "$INSTALL_DIR/requirements.txt" 2>/dev/null; then echo "✅ Dependencies installed" else echo "⚠️ pip install failed — try manually: pip3 install -r $INSTALL_DIR/requirements.txt" fi ``` ```bash pip3 install --break-system-packages -q -r "$PROJECT/requirements.txt" 2>/dev/null || true ``` ### Technical Analysis Every requirement specifies only a minimum version. Future releases can therefore be installed without review, and package hashes are not verified. The preferred installation path uses `--break-system-packages`, which bypasses protections intended to prevent pip from modifying an externally managed Python environment. This can alter dependencies used by unrelated applications and broadens the effect of a compromised or incompatible release. The audit did not identify a known typosquatted package in this list. The issue is the unsafe resolution and installation policy, not evidence that the listed packages are currently malicious. ### Attack Path 1. A dependency account, release pipeline, package index, or future package version is compromised. 2. Setup or update resolves the newest version satisfying the open-ended `>=` constraint. 3. Pip downloads and installs the package without hash verification. 4. Installation hooks or imported runtime code execute with the ...[truncated 468 chars]- Remediation
View remediation
other
Warning
- Location
src/modules/ai_coach.py:130- Finding
Sensitive Portfolio and Behavioral Data Is Sent to Anthropic Without Adequate Disclosure
- Content
View full analysis
str: """Core API call with error handling.""" msg = self.client.messages.create( model=self.model, max_tokens=max_tokens, system=system, messages=[{"role": "user", "content": user}], ) return msg.content[0].text ``` ```python user = f"""Please provide a personalized coaching summary based on this data: ## Portfolio - Total value: ${portfolio['total_usd']:,.2f} - Health score: {portfolio['score']}/100 (Grade {portfolio['grade']}) - Holdings: {portfolio['n_assets']} meaningful positions - Stablecoin reserve: {portfolio['stable_pct']}% - Current issues: {', '.join(portfolio['suggestions']) if portfolio['suggestions'] else 'none'} ## Market Conditions (BTC as benchmark) - BTC price: ${market_ctx['price']:,.2f} - RSI: {market_ctx['rsi']} ({market_ctx['rsi_zone']}) - Trend: {market_ctx['trend']} - vs 200-day SMA: {market_ctx['vs_sma200_pct']:+.1f}% - Fear & Greed: {market_ctx['fear_greed']['value']} ({market_ctx['fear_greed']['classification']}) ## Behavioral Analysis - FOMO score: {behavior.get('fomo_score', 0)}/100 ({behavior.get('fomo_label', 'N/A')}) - Trades last 30d: {behavior.get('total_trades', 0)} ({behavior.get('per_week', 0)}/week) - Overtrading label: {behavior.get('overtrade_label', 'N/A')} - Recent panic sells detected: {behavior.get('panic_count', 0)} """ ``` The free-form chat path also includes up to ten holdings with asset names, USD values, and allocation percentages before calling the Anthropic API. ### Technical Analysis Sending context to Anthropic is functionally relevant to optional standalone AI coaching. However, setup states that nothing is sent externally except to Bi ...[truncated 1395 chars]- Remediation
View remediation
T02 · Agent Memory Poisoning
Warning
- Location
src/modules/journal.py:295- Finding
Trading Journal Entries Are Automatically Written Into Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/daily_analysis.py:143- Finding
Telegram Bot Token May Be Exposed in Exception Output
- Content
View full analysis
- Remediation
View remediation
")`. - Centralize Telegram API communication in one helper that consistently performs redaction. - Avoid logging full request URLs containing credentials. - Use structured logging with an explicit denylist for secrets. - Do not print the complete portfolio report after transport failures unless the user explicitly requests local output. - Ensure scheduled-task logs have restrictive permissions and bounded retention. - Add automated tests that simulate request failures and assert that tokens never appear in output. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (129)
YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]
Critical
- Category
- YARA Match
- Confidence
- 85% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
python ot from modules.market import MarketData from modules.portfolio import Portfolio from modules.dca import DCAAdvisor from modules.coach_db import CoachDB # ── Setup ───────────────────────────────────────────────────────────────────── api_key = os.getenv("BINANCE_API_KEY", "") api_secret = os.getenv("BINANCE_API_SECRET", "") tg_token = os.getenv("TELEGRAM_BOT_TOKEN", "") tg_chat = os.getenv("TELEGRAM_USER_ID", "") budget = float(os.getenv("DCA_BUDGET_MONTHLY", "400")) risk = os.getenv("RISK_PROFILE", "moderate") client = Spot(api_key=api_key, api_secret=api_secret) market = MarketData(client) portfolio = Portfolio(client, market) dca = DCAAdvisor(market, monthly_budget=budget, risk_profile=risk) db = CoachDB() hour = datetime.now().hour session = "🌅 Morning" if hour < 15 else "🌆 Evening" d
Tainted flow: 'tg_token' from os.getenv (line 25, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python if tg_token: try: requests.post( f"https://api.telegram.org/bot{tg_token}/sendMessage", json={"chat_id": tg_chat, "text": msg, "parse_mode": "HTML"}, timeout=10,
YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]
Critical
- Category
- YARA Match
- Confidence
- 85% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
python es, "🌾 Launchpool & HODLer Airdrops") # ── Watcher daemon ─────────────────────────────────────────────────────────── def _is_openclaw_mode() -> bool: """Detect if running under OpenClaw (no bot token, but openclaw CLI available).""" import shutil token = os.getenv("TELEGRAM_BOT_TOKEN", "") if token: return False # Has bot token, use direct Telegram API return shutil.which("openclaw") is not None def _send_openclaw(chat_id: str, text: str) -> bool: """Send message via OpenClaw CLI. Returns True on success.""" import subprocess try: # Use openclaw message send with Telegram target result = subprocess.run( ["openclaw", "message", "send", "--channel", "telegram", "--to", f"telegram:{chat_id}", "--message", text], capture_output=True,
Tainted flow: 'token' from os.getenv (line 287, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python return try: requests.post( f"https://api.telegram.org/bot{token}/sendMessage", json={"chat_id": chat_id, "text": text, "parse_mode": "HTML"}, timeout=10,
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the skill performs persistent journaling, local database storage, P&L tracking, and writes to memory files without clearly disclosing this in the main purpose, it creates hidden data-retention and privacy risks. Users may share trading data expecting transient coaching, while the skill silently creates durable local records that could expose sensitive financial history.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the skill performs persistent journaling, local database storage, P&L tracking, and writes to memory files without clearly disclosing this in the main purpose, it creates hidden data-retention and privacy risks. Users may share trading data expecting transient coaching, while the skill silently creates durable local records that could expose sensitive financial history.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the skill performs persistent journaling, local database storage, P&L tracking, and writes to memory files without clearly disclosing this in the main purpose, it creates hidden data-retention and privacy risks. Users may share trading data expecting transient coaching, while the skill silently creates durable local records that could expose sensitive financial history.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the skill performs persistent journaling, local database storage, P&L tracking, and writes to memory files without clearly disclosing this in the main purpose, it creates hidden data-retention and privacy risks. Users may share trading data expecting transient coaching, while the skill silently creates durable local records that could expose sensitive financial history.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the skill performs persistent journaling, local database storage, P&L tracking, and writes to memory files without clearly disclosing this in the main purpose, it creates hidden data-retention and privacy risks. Users may share trading data expecting transient coaching, while the skill silently creates durable local records that could expose sensitive financial history.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the skill performs persistent journaling, local database storage, P&L tracking, and writes to memory files without clearly disclosing this in the main purpose, it creates hidden data-retention and privacy risks. Users may share trading data expecting transient coaching, while the skill silently creates durable local records that could expose sensitive financial history.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the skill performs persistent journaling, local database storage, P&L tracking, and writes to memory files without clearly disclosing this in the main purpose, it creates hidden data-retention and privacy risks. Users may share trading data expecting transient coaching, while the skill silently creates durable local records that could expose sensitive financial history.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the skill performs persistent journaling, local database storage, P&L tracking, and writes to memory files without clearly disclosing this in the main purpose, it creates hidden data-retention and privacy risks. Users may share trading data expecting transient coaching, while the skill silently creates durable local records that could expose sensitive financial history.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 97% confidence
- Finding
The hidden HTML comment contains agent-directed instructions pointing to an external dispatch guide, which is a classic prompt injection and transparency problem. Hidden control text can influence orchestration behavior in ways users cannot see, and externalized instructions may expand actions or routing beyond what is disclosed in the visible manifest.
- Content
md --- <!-- AGENT INSTRUCTIONS — read references/agent-guide.md for full dispatch table -->
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 92% confidence
- Finding
Advertising an 'Update skill' command in the dispatch table normalizes agent-triggered self-modification and runtime code replacement. In context, the skill is supposed to coach users about Binance activity, so embedding self-update capability broadens trust and increases supply-chain risk.
- Content
md | Watcher running? | `bc.sh watch-status` | | Start Telegram bot | `bc.sh telegram` | | Demo mode | `bc.sh demo` | | Update skill | `bc.sh update` | Available learn topics: `rsi_oversold`, `rsi_overbought`, `fear_greed`, `dca`, `sma_200`, `concentration_risk`, `panic_selling`
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
source "$PROJECT/.env"executes the contents of the.envfile as shell code, not merely as data. If an attacker can modify that file, they can achieve arbitrary command execution in the user's context whenever the wrapper runs, and exported secrets also become available to child processes.- Content
sh ARGS=("$@") # ── Load .env ──────────────────────────────────────────────────────────────── if [[ -f "$PROJECT/.env" ]]; then set -o allexport; source "$PROJECT/.env"; set +o allexport fi
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 96% confidence
- Finding
The update path explicitly modifies the installed skill by pulling new content and replacing local source files. In a security context this is dangerous because it introduces self-modification and trust in remote update infrastructure; compromise of the registry, repository, or dependency supply chain can lead to execution of attacker-controlled code.
- Content
sh [[ "$confirm" =~ ^[Yy]$ ]] || { echo "Update cancelled."; exit 0; } echo "" echo "🔄 Updating BinanceCoach skill..." # Step 1: Update skill files via ClaWHub if command -v clawhub &>/dev/null; then clawhub update binance-coach && echo "✅ Skill updated from ClaWHub" else
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh TMP_ENV=$(mktemp) cp "$PROJECT/.env" "$TMP_ENV" 2>/dev/null || true # Copy new source (excludes .env and data/) rsync -a --exclude='.env' --exclude='data/' "$SRC_DIR/" "$PROJECT/" 2>/dev/null || \ cp -r "$SRC_DIR/." "$PROJECT/" # Restore .env [[ -f "$TMP_ENV" ]] && cp "$TMP_ENV" "$PROJECT/.env"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # Auto-detect skill location SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" BC="bash ${SCRIPT_DIR}/bc.sh" ENV_FILE="$HOME/workspace/binance-coach/.env" PYTHON="/opt/homebrew/bin/python3" if [ -f "$ENV_FILE" ]; then
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # Auto-detect skill location SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" BC="bash ${SCRIPT_DIR}/bc.sh" ENV_FILE="$HOME/workspace/binance-coach/.env" PYTHON="/opt/homebrew/bin/python3" if [ -f "$ENV_FILE" ]; then
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # Auto-detect skill location SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" BC="bash ${SCRIPT_DIR}/bc.sh" ENV_FILE="$HOME/workspace/binance-coach/.env" PYTHON="/opt/homebrew/bin/python3" if [ -f "$ENV_FILE" ]; then
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # Auto-detect skill location SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" BC="bash ${SCRIPT_DIR}/bc.sh" ENV_FILE="$HOME/workspace/binance-coach/.env" PYTHON="/opt/homebrew/bin/python3" if [ -f "$ENV_FILE" ]; then
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # Auto-detect skill location SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" BC="bash ${SCRIPT_DIR}/bc.sh" ENV_FILE="$HOME/workspace/binance-coach/.env" PYTHON="/opt/homebrew/bin/python3" if [ -f "$ENV_FILE" ]; then
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # Auto-detect skill location SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" BC="bash ${SCRIPT_DIR}/bc.sh" ENV_FILE="$HOME/workspace/binance-coach/.env" PYTHON="/opt/homebrew/bin/python3" if [ -f "$ENV_FILE" ]; then
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # Auto-detect skill location SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" BC="bash ${SCRIPT_DIR}/bc.sh" ENV_FILE="$HOME/workspace/binance-coach/.env" PYTHON="/opt/homebrew/bin/python3" if [ -f "$ENV_FILE" ]; then
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # Auto-detect skill location SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" BC="bash ${SCRIPT_DIR}/bc.sh" ENV_FILE="$HOME/workspace/binance-coach/.env" PYTHON="/opt/homebrew/bin/python3" if [ -f "$ENV_FILE" ]; then
Static analysis
No suspicious patterns detected.