Barra

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:56 AM UTC
• Version: 0.1.4

Overview

This Binance trading skill is purpose-aligned, but it can trigger real crypto buy orders without a documented final confirmation and its permission metadata contains an invisible character that may confuse parsing.

Review carefully before installing. Only use this with a tightly scoped Binance API key that has withdrawals disabled and IP restrictions enabled, and do not rely on it unless the skill or host enforces a final explicit confirmation before every trade.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:11

Finding

Invisible Unicode Character Corrupts the Front-Matter Delimiter

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 11
Vulnerability Type: Malformed configuration caused by an invisible Unicode control character
Risk Level: Low

Vulnerable Code

yaml

permissions:
  - binance.trading
  - binance.account.read
​---

The delimiter on line 11 contains an invisible U+200B ZERO WIDTH SPACE before the three hyphens. Its effective representation is:

text

\u200B---

Technical Analysis

YAML front matter must normally be closed by a delimiter consisting of exactly three hyphens. The hidden character means line 11 is not byte-for-byte equivalent to ---.

Strict parsers may therefore treat the front matter as unterminated, while permissive parsers or preprocessing tools may remove or ignore the character and recognize the delimiter. This parser differential can cause validation and runtime components to interpret the same skill differently.

In this package, the affected front matter declares sensitive Binance permissions:

yaml

permissions:
  - binance.trading
  - binance.account.read

No malicious executable payload or demonstrated privilege-escalation implementation was found. Nevertheless, invisible characters in security-relevant configuration syntax are unsafe because they can conceal malformed metadata from reviewers and produce inconsistent permission or loading behavior.

Attack Path

1. A platform ingests SKILL.md and attempts to parse its YAML front matter.
2. A strict parser encounters the hidden U+200B character and does not recognize line 11 as the closing delimiter.
3. The platform rejects the skill, treats subsequent documentation as metadata, or produces an incomplete metadata representation.
4. If separate validation and runtime components normalize Unicode differently, one component may approve a different interpretation from the one used when loading the skill.
5. Depending on the host platform's erro ...[truncated 635 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the U+200B ZERO WIDTH SPACE and replace line 11 with a plain ASCII delimiter:

   yaml

   ---
   

2. Recreate the delimiter manually rather than copying the existing line, ensuring its byte sequence is exactly 2D 2D 2D.

3. Add a CI validation step that rejects invisible or format-control Unicode characters in YAML delimiters, permission declarations, executable instructions, and other security-sensitive configuration.

4. Parse the front matter with the same parser and normalization rules during validation and runtime.

5. Fail closed when front matter is malformed; do not infer or grant permissions from partially parsed metadata.

6. Add a schema check confirming that the front matter closes correctly and that requested permissions are limited to the declared skill functionality.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: "Barra 币安现货交易技能"
version: "1.0.0"
description: "在币安交易所执行比特币（BTC）的现货买入操作，支持市价单和限价单"
author: "Your Name"
tags:
  - 币安
  - 现货交易
  - 比特币
  - 交易执行
permissions:
  - binance.trading
  - binance.account.read
​---

# Barra 币安现货交易技能使用指南

## 功能概述
该技能允许你通过自然语言指令，让OpenClaw在币安交易所执行比特币（BTC）的现货买入操作。技能会处理从指令解析到订单执行的全过程，并返回交易结果。

## 工作流程
1. **指令解析**：AI从你的对话中提取交易

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 87% confidence

Finding

The hidden or non-printing character near the YAML boundary is suspicious because invisible text can conceal instructions, alter parser behavior, or cause the manifest shown to reviewers to differ from what tooling interprets. In agent skill files, this increases the risk of instruction smuggling or metadata confusion even if the current instance appears minimal.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

permissions:
  - binance.trading
  - binance.account.read
​---

# Barra 币安现货交易技能使用指南

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This skill enables live cryptocurrency purchases through natural-language instructions but does not require a clear explicit-confirmation step immediately before order submission. In a trading context, ambiguous parsing, accidental prompts, or prompt injection from surrounding conversation could cause irreversible fund expenditure, making the omission materially dangerous.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill name, description, and usage instructions are all presented in Chinese, and the file does not indicate that the user can choose another language or that the skill is intentionally restricted to a Chinese-language audience for compliance or regional reasons. This can violate a language/locale policy that requires opt-in or documented justification for enforced language use.

Content

No source excerpt is available for this finding.