ClawHub
Back to skill

Security audit

Binance Crypto Price

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward cryptocurrency price lookup tool that clearly uses Binance's public API and shows no hidden data access, persistence, or destructive behavior.

Before installing, understand that this skill contacts Binance to fetch market prices and may install or resolve the Python requests package through uv. It does not require an API key and I found no evidence that it reads private local data, but cautious users should run it in a normal least-privilege environment and prefer a pinned lockfile for dependency reproducibility.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/cryptoprice.py:2
Finding
Unpinned Runtime Dependency Creates Supply-Chain Exposure## Vulnerability Details **File Location**: `scripts/cryptoprice.py:2-7`; invocation documented at `SKILL.md:13-31` **Vulnerability Type**: Unpinned third-party dependency resolved at runtime **Risk Level**: Medium ### Vulnerable Code `scripts/cryptoprice.py:2-7`: ```python # /// script # requires-python = ">=3.10" # dependencies = [ # "requests>=2.28.0", # ] # /// ``` Relevant documented invocations in `SKILL.md:13-31`: ```bash uv run ~/.openclaw/skills/cryptoprice/scripts/cryptoprice.py ``` ```bash uv run ~/.openclaw/skills/cryptoprice/scripts/cryptoprice.py BTCUSDT uv run ~/.openclaw/skills/cryptoprice/scripts/cryptoprice.py ETHUSDT uv run ~/.openclaw/skills/cryptoprice/scripts/cryptoprice.py BTC ``` ```bash uv run ~/.openclaw/skills/cryptoprice/scripts/cryptoprice.py --json uv run ~/.openclaw/skills/cryptoprice/scripts/cryptoprice.py BTC --json ``` ### Technical Analysis The inline dependency declaration specifies only a lower bound for `requests`. It therefore allows `uv` to resolve and download future releases of `requests` and compatible versions of its transitive dependencies that were not part of this audit. Because the documented execution method is `uv run`, dependency resolution may occur when the Skill is invoked in an environment without an already locked and cached dependency set. The effective code executed by the Skill can consequently change over time without any modification to the audited repository. This is a supply-chain weakness rather than evidence that the currently available `requests` package or the Skill itself is malicious. Exploitation depends on compromise of an allowed package release, a configured package registry, dependency resolution infrastructure, or an equivalent package-source attack. ### Attack Path 1. An attacker compromises an allowed future release of `requests`, one of its transitive dependencies, or a package source trusted by the local `uv` configuration. 2. The user invokes the Skill through a doc ...[truncated 1153 chars]
Remediation
## Remediation Suggestions 1. Pin `requests` and every transitive dependency to exact, reviewed versions instead of using a lower-bound-only constraint. 2. Generate and commit a lockfile containing the complete resolved dependency graph. 3. Include cryptographic hashes for downloaded artifacts where supported, and require hash verification during installation. 4. Run the Skill with locked or frozen dependency resolution so execution fails rather than silently selecting newer packages. 5. Configure `uv` to use an explicitly trusted package index and prevent unintended fallback to untrusted or user-controlled registries. 6. Review dependency updates before changing the lockfile, including package provenance, release metadata, and known vulnerability reports. 7. Execute the Skill under a least-privileged account or sandbox with only the filesystem and network access required to query the Binance API.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill documents network access to the Binance API, but the manifest does not declare any tool scope such as permissions or allowed-tools. This creates a mismatch between declared and actual capability, which weakens user visibility and policy enforcement around outbound network use.

External Transmission

Medium
Category
Data Exfiltration
Content
sys.exit(1)


BINANCE_API_URL = "https://api.binance.com/api/v3/ticker/price"

# List of popular cryptocurrencies
POPULAR_SYMBOLS = [
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
sys.exit(1)


BINANCE_API_URL = "https://api.binance.com/api/v3/ticker/price"

# List of popular cryptocurrencies
POPULAR_SYMBOLS = [
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.