ClawHub
Back to skill

Security audit

Binance Crypto Price

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward cryptocurrency price lookup tool that clearly uses Binance's public API and shows no hidden data access, persistence, or destructive behavior.

Before installing, understand that this skill contacts Binance to fetch market prices and may install or resolve the Python requests package through uv. It does not require an API key and I found no evidence that it reads private local data, but cautious users should run it in a normal least-privilege environment and prefer a pinned lockfile for dependency reproducibility.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/cryptoprice.py:2
Finding

Unpinned Runtime Dependency Creates Supply-Chain Exposure

Content
View full analysis

Vulnerability Details

File Location: scripts/cryptoprice.py:2-7; invocation documented at SKILL.md:13-31
Vulnerability Type: Unpinned third-party dependency resolved at runtime
Risk Level: Medium

Vulnerable Code

scripts/cryptoprice.py:2-7:

python
# /// script
# requires-python = ">=3.10"
# dependencies = [
#     "requests>=2.28.0",
# ]
# ///

Relevant documented invocations in SKILL.md:13-31:

bash
uv run ~/.openclaw/skills/cryptoprice/scripts/cryptoprice.py
bash
uv run ~/.openclaw/skills/cryptoprice/scripts/cryptoprice.py BTCUSDT
uv run ~/.openclaw/skills/cryptoprice/scripts/cryptoprice.py ETHUSDT
uv run ~/.openclaw/skills/cryptoprice/scripts/cryptoprice.py BTC
bash
uv run ~/.openclaw/skills/cryptoprice/scripts/cryptoprice.py --json
uv run ~/.openclaw/skills/cryptoprice/scripts/cryptoprice.py BTC --json

Technical Analysis

The inline dependency declaration specifies only a lower bound for requests. It therefore allows uv to resolve and download future releases of requests and compatible versions of its transitive dependencies that were not part of this audit.

Because the documented execution method is uv run, dependency resolution may occur when the Skill is invoked in an environment without an already locked and cached dependency set. The effective code executed by the Skill can consequently change over time without any modification to the audited repository.

This is a supply-chain weakness rather than evidence that the currently available requests package or the Skill itself is malicious. Exploitation depends on compromise of an allowed package release, a configured package registry, dependency resolution infrastructure, or an equivalent package-source attack.

Attack Path

  1. An attacker compromises an allowed future release of requests, one of its transitive dependencies, or a package source trusted by the local uv configuration.
  2. The user invokes the Skill through a doc ...[truncated 1153 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin requests and every transitive dependency to exact, reviewed versions instead of using a lower-bound-only constraint.
  2. Generate and commit a lockfile containing the complete resolved dependency graph.
  3. Include cryptographic hashes for downloaded artifacts where supported, and require hash verification during installation.
  4. Run the Skill with locked or frozen dependency resolution so execution fails rather than silently selecting newer packages.
  5. Configure uv to use an explicitly trusted package index and prevent unintended fallback to untrusted or user-controlled registries.
  6. Review dependency updates before changing the lockfile, including package provenance, release metadata, and known vulnerability reports.
  7. Execute the Skill under a least-privileged account or sandbox with only the filesystem and network access required to query the Binance API.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill documents network access to the Binance API, but the manifest does not declare any tool scope such as permissions or allowed-tools. This creates a mismatch between declared and actual capability, which weakens user visibility and policy enforcement around outbound network use.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md
sys.exit(1)


BINANCE_API_URL = "https://api.binance.com/api/v3/ticker/price"

# List of popular cryptocurrencies
POPULAR_SYMBOLS = [

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/cryptoprice.py (reported line 33)May include surrounding context.

python
sys.exit(1)


BINANCE_API_URL = "https://api.binance.com/api/v3/ticker/price"

# List of popular cryptocurrencies
POPULAR_SYMBOLS = [

Static analysis

No suspicious patterns detected.