Binance Futures Strategy Analysis

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:48 PM UTC
• Version: 1.0.0

Overview

The skill is mostly aligned with public Binance futures analysis, but it depends on unaudited parent-directory strategy files that can change the agent’s effective instructions after review.

Install only if you trust the repository context that will provide the external strategy files, because those files are outside this package and can materially change the analysis. Do not provide exchange credentials, API keys, or sensitive account details; if you share balances or positions, treat the output as personalized high-risk trading commentary, not an automated trading action.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:14
• Finding: Untrusted Instructions Loaded from Outside the Audited Skill Boundary## Vulnerability Details **File Location**: `SKILL.md:14-16, 24`; related references at `references/analysis-mode.md:7-8` and `references/system-prompt-coverage.md:3` **Vulnerability Type**: External instruction injection through path traversal outside the Skill package **Risk Level**: Medium ### Vulnerable Code `SKILL.md:14-24`: ```markdown 1. Read the canonical strategy source at `../../../src/main/resources/system-prompt.txt`. 2. Read `references/system-prompt-coverage.md` before analysis. It mirrors the canonical rules in skill-friendly form and includes the analysis-only output adaptation. 3. Read `../../../docs/core-feature-spec.md` only if you need the project's original execution flow and field semantics. 4. Read `references/analysis-mode.md` before deciding, because this skill runs in analysis-only mode instead of live execution mode. 5. Normalize user input symbols to Binance USDT perpetual symbols: - `BTC` -> `BTCUSDT` - `ETH` -> `ETHUSDT` - `BTCUSDT` stays `BTCUSDT` 6. Run `python3 scripts/binance_futures_snapshot.py <SYMBOL...>` with the user symbols. 7. Use the script output as the only market data source unless the user gives additional account context. 8. Apply the strategy rules from `system-prompt.txt` exactly. Do not simplify the decision logic just because this skill is analysis-only. ``` `references/analysis-mode.md:7-8`: ```markdown - Primary rule source: `../../../src/main/resources/system-prompt.txt` - Execution-field semantics: `../../../docs/core-feature-spec.md` ``` `references/system-prompt-coverage.md:3`: ```markdown This file is the skill-side checklist for the canonical strategy in `../../../src/main/resources/system-prompt.txt`. ``` ### Technical Analysis The Skill explicitly instructs the agent to traverse outside the audited project root and load `system-prompt.txt` and `core-feature-spec.md`. These files are not included in the supplied artifact, ...[truncated 2850 chars]
• Remediation: ## Remediation Suggestions 1. Bundle all authoritative strategy rules and field definitions inside the Skill package so they are covered by the same review and distribution process. 2. Remove parent-directory references such as `../../../` and enforce canonical-path validation that rejects any resolved path outside the Skill root. 3. If external files are operationally required, pin an approved cryptographic digest and verify it before reading the file. Fail closed when validation fails. 4. Treat external documents as untrusted data rather than executable agent instructions. Parse only a strict, documented schema containing required strategy parameters. 5. Explicitly prohibit external content from changing system constraints, tool permissions, data-access boundaries, or output-integrity requirements. 6. Use an allowlisted absolute repository root supplied by trusted configuration rather than relying on runtime-relative path resolution. 7. Add automated tests confirming that missing, modified, symlinked, or out-of-root rule files cause execution to stop safely. 8. Version the bundled strategy rules and display or log the verified version used for each analysis to provide traceability.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The description promises a bounded analysis skill that returns a BUY/SELL/HOLD report, but the actual behavior depends on a helper script that emits raw analytics JSON and includes additional market-microstructure capabilities like depth and slippage estimation. This mismatch can mislead reviewers and policy systems about what the skill really does, weakening oversight and enabling use outside the declared, user-visible scope.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs the agent to run a Python script that fetches public Binance futures data, but it declares no explicit tool scope or allowed-tools boundary. This creates an authorization and containment gap: an agent/runtime may permit broader networked code execution than intended, making it harder to enforce that only the expected public-data access occurs.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The manifest description says to use the skill when the user asks for 'buy/sell analysis, trade strategy, long/short judgment, setup review, support and resistance analysis, or detailed futures market commentary,' which is a wide set of common phrases. It does not provide negative examples or narrow activation constraints beyond Binance futures intent, increasing the chance of unintended invocation for general market discussion.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The file instructs the skill to keep `reason` in simplified Chinese and to default to a structured Chinese analysis report. This is a language policy constraint applied unconditionally, with no user choice or opt-in mechanism documented.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The default prompt hard-codes a Chinese-language output requirement without any indication that the user requested or consented to that language. This can override user preferences, reduce transparency, and create opportunities for instruction-priority confusion where the model follows embedded skill constraints instead of the user's explicit needs.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill metadata says analysis should use public futures market data only and explicitly not place orders, but this document allows substituting real account values and current positions into the analysis flow. That broadens the skill from generic market commentary into personalized trading guidance based on sensitive portfolio context, creating scope drift and increasing the chance the agent will solicit, retain, or misuse account-specific information.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The instruction 'Default to a structured Chinese analysis report' imposes a specific language choice on users without offering an opt-in or alternative. This is a natural-language policy issue because it constrains locale/language behavior across all uses of the skill.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Also enforce:

- no impulse chasing without confirmation
- one action per symbol per 15m bar

## 4.1 Counter-Trend Rebound Logic

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The instruction "Then present it as structured Chinese analysis by default" imposes a specific language choice regardless of the user's preference. This is a natural-language policy concern because the file does not offer a language choice or require explicit opt-in for Chinese output.

Static analysis

No suspicious patterns detected.