bingx-spot-trade

Warn

Audited by Snyk on Oct 10, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 0.70). The skill provides authenticated API endpoints to place and cancel spot trading orders on BingX (e.g., /openApi/spot/v1/trade/order, /openApi/spot/v1/trade/cancel), which are direct financial operations (trades/purchases). These operations rely on API credentials (HMAC SHA256 signature authentication using API keys) supplied by the agent, without independent service-layer access control gating transaction execution (such as exchange-side multi-factor auth or independent human approval required by the service layer itself; agent-enforced prompts like "Type CONFIRM" are instruction-based only).

Issues (1)

W009
MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 10, 2026, 10:52 AM
Issues
1