Trust Assessment
binance-pro received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 1 finding: 1 critical, 0 high, 0 medium, and 0 low severity. Key findings include Command Injection via unsanitized user input in shell commands.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Command Injection via unsanitized user input in shell commands The skill constructs API request query strings by directly interpolating variables (e.g., `SYMBOL`, `SIDE`, `QUANTITY`, `STOP_PRICE`, `TP_PRICE`, `LEVERAGE`, `ORDER_ID`) into a `QUERY` variable. This `QUERY` variable is then passed to `echo -n "$QUERY" | openssl dgst ...`. If any of these interpolated variables, which are expected to be user-controlled, contain shell metacharacters (e.g., `;`, `&`, `|`, `$(...)`, `` ` ``), they will be interpreted and executed by the shell when `echo` processes the `QUERY` string. This allows for arbitrary command execution, potentially leading to data exfiltration, credential compromise, or system damage. This vulnerability is present in multiple API calls that require a signature and involve user-controlled parameters. All user-controlled variables (`SYMBOL`, `SIDE`, `QUANTITY`, `STOP_PRICE`, `TP_PRICE`, `LEVERAGE`, `ORDER_ID`) must be strictly validated against expected patterns (e.g., alphanumeric, numeric) and/or properly shell-escaped before being included in the `QUERY` string. For shell environments, `printf %q` can be used for escaping. A more robust solution would be to construct the query and perform HMAC signing in a programming language that offers safer string handling and prevents shell interpretation of input. | LLM | SKILL.md:46 |
Scan History
Embed Code
[](https://skillshield.io/report/5e72737335af48e5)
Powered by SkillShield