binance-spot-openapi-skill

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The validation script and documentation reference an external GitHub repository URL to download an OpenAPI schema at runtime, which constitutes an operational inbound dependency on a third-party source.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill operates Binance Spot market, account, and order APIs (post:/api/v3/order, delete:/api/v3/order), which execute direct trades/purchases/financial instructions. While it configures API keys and cryptographic signing (X-MBX-APIKEY, Ed25519/HMAC signatures) to authenticate requests against the Binance API, these represent client credentials rather than an independent service-enforced access control or external approval check gating the execution layer.