T09 · Insecure Skill Coding Practices
Warning
- Location
monitor.js:21- Finding
Hard-Coded Feishu Recipient and Ignored Runtime Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
Binance Monitor
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its Binance/X monitoring purpose, but it hard-codes a Feishu recipient and ignores the documented recipient configuration, so alerts may go to an unintended account.
Before installing, replace the hard-coded targetUser values in monitor.js, x-monitor.js, config.json, and config.example.json with a recipient you control, or require the scripts to load and validate config.json. Avoid the documented cron pkill restart; use one clearly scoped lifecycle manager and document how to stop or remove it. Confirm you are comfortable sending monitored Binance/X content through Jina AI and Feishu-related notification handling.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T06 · System Persistence
Warning
- Location
README.md:437- Finding
Persistent Cron Recommendation Uses Overbroad Process Matching
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
monitor.js:65- Finding
Unbounded HTTP Response Buffering and Missing Network Safety Controls
- Content
View full analysis
{ https.get(CONFIG.announceUrl, { headers: { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Accept': 'application/json' } }, (res) => { let data = ''; res.on('data', chunk => data += chunk); res.on('end', () => { try { const json = JSON.parse(data); const articles = json.data?.catalogs?.[0]?.articles || []; resolve(articles); } catch (e) { reject(new Error('JSON parse failed: ' + e.message)); } }); }).on('error', (e) => { reject(new Error('Network request failed: ' + e.message)); }); }); } ``` `x-monitor.js:78-100` follows the same pattern: ```javascript function fetchTweets(account) { return new Promise((resolve, reject) => { https.get(account.url, { headers: { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Accept': 'text/plain' } }, (res) => { let data = ''; res.on('data', chunk => data += chunk); res.on('end', () => { try { const tweets = parseJinaResponse(data, account); resolve(tweets); } catch (e) { reject(new Error('Parse failed: ' + e.message)); } }); }).on('error', (e) => { reject(new Error('Network request failed: ' + e.message)); }); ...[truncated 2168 chars]- Remediation
View remediation
{ let settled = false; const fail = (error) => { if (settled) return; settled = true; reject(error); }; const req = https.get(url, { headers: { 'User-Agent': 'BinanceMonitor/1.1', 'Accept': expectedType } }, (res) => { if (res.statusCode !== 200) { res.resume(); return fail(new Error(`Unexpected HTTP status: ${res.statusCode}`)); } const type = String(res.headers['content-type'] || '').toLowerCase(); if (!type.includes(expectedType.split('/')[1])) { res.resume(); return fail(new Error(`Unexpected content type: ${type}`)); } let size = 0; const chunks = []; res.on('data', (chunk) => { size += chunk.length; if (size > maxBytes) { res.destroy(new Error('Response exceeded size limit')); return; } chunks.push(chunk); }); res.on('end', () => { if (settled) return; settled = true; resolve(Buffer.concat(chunks).toString('utf8')); }); res.on('error', fail); }); req.setTimeout(10000, () => ...[truncated 260 chars]
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (32)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `monitor.js` | 主监控脚本 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `monitor.js` | 主监控脚本 |
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
js const tweetIds = Object.keys(state.seenTweets); if (tweetIds.length > 200) { tweetIds.slice(0, tweetIds.length - 200).forEach(id => { delete state.seenTweets[id]; }); }
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README explicitly states that monitored Binance/X content is fetched via Jina AI and delivered via Feishu, but it does not clearly warn users that monitored content and related metadata may be transmitted to third-party services. In a monitoring skill, this matters because users may assume content stays local except for notifications, while the design depends on external processors.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md sudo systemctl start binance-monitor # 查看状态 sudo systemctl status binance-monitor # 查看日志 sudo journalctl -u binance-monitor -f
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The entire skill description and operating instructions are presented in Chinese, with no indication that other languages are supported or that the locale restriction is intentional and justified. Per the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill describes continuous polling of Binance/X and immediate delivery to Feishu, but it does not clearly warn users that content and metadata are transmitted to external services. This can mislead users about privacy exposure, especially if monitored content, recipient identifiers, timestamps, or logs are sensitive in their environment.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
后台运行（推荐）
bash # 使用 nohup nohup node monitor.js > monitor.log 2>&1 & # 或使用 screen
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
后台运行（推荐）
bash # 使用 nohup nohup node monitor.js > monitor.log 2>&1 & # 或使用 screen
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
后台运行（推荐）
bash # 使用 nohup nohup node monitor.js > monitor.log 2>&1 & # 或使用 screen
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
后台运行（推荐）
bash # 使用 nohup nohup node monitor.js > monitor.log 2>&1 & # 或使用 screen
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
后台运行（推荐）
bash # 使用 nohup nohup node monitor.js > monitor.log 2>&1 & # 或使用 screen
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ctrl+A, D 退出屏幕
或使用 systemd（生产环境）
sudo systemctl enable binance-monitor sudo systemctl start binance-monitor
text
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ctrl+A, D 退出屏幕
或使用 systemd（生产环境）
sudo systemctl enable binance-monitor sudo systemctl start binance-monitor
text
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ctrl+A, D 退出屏幕
或使用 systemd（生产环境）
sudo systemctl enable binance-monitor sudo systemctl start binance-monitor
text
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ctrl+A, D 退出屏幕
或使用 systemd（生产环境）
sudo systemctl enable binance-monitor sudo systemctl start binance-monitor
text
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ctrl+A, D 退出屏幕
或使用 systemd（生产环境）
sudo systemctl enable binance-monitor sudo systemctl start binance-monitor
text
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ctrl+A, D 退出屏幕
或使用 systemd（生产环境）
sudo systemctl enable binance-monitor sudo systemctl start binance-monitor
text
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Ctrl+A, D 退出屏幕
或使用 systemd（生产环境）
sudo systemctl enable binance-monitor sudo systemctl start binance-monitor
text
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Ctrl+A, D 退出屏幕
或使用 systemd（生产环境）
sudo systemctl enable binance-monitor sudo systemctl start binance-monitor
text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
const OKX_ANNOUNCE_URL = 'https://www.okx.com/api/v5/support/announcements';
// 示例：Bybit 公告 const BYBIT_ANNOUNCE_URL = 'https://api.bybit.com/spot/v1/announcement';
text ### 添加其他通知渠道
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
const OKX_ANNOUNCE_URL = 'https://www.okx.com/api/v5/support/announcements';
// 示例：Bybit 公告 const BYBIT_ANNOUNCE_URL = 'https://api.bybit.com/spot/v1/announcement';
text ### 添加其他通知渠道
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file presents its description and runtime messages in Chinese, including the stated purpose and multiple console outputs, without any indication that the user can choose another language or that the skill is intentionally limited to Chinese-speaking users. This is a natural-language locale constraint that appears hard-coded rather than optional.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file’s natural-language description and user-facing messages are written in Chinese and present the skill as a Binance notification sender without any indication that language is configurable or optional. Under the stated policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script's user-facing comments and runtime messages are written in Chinese throughout, including errors, status, and usage guidance. For a general-purpose startup script, this imposes a specific language on users without any opt-in, fallback, or documented region-specific justification.
- Content