p2p
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill communicates exclusively with well-known and official domains (binance.com and api.binance.com) for data retrieval and authentication.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill uses sensitive environment variables (BINANCE_API_KEY, BINANCE_SECRET_KEY), but it follows best practices by instructing users to store them in .env files and masking them in any output.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from the Binance P2P marketplace, creating a potential attack surface. Evidence: 1. Ingestion points: Merchant names and ad details fetched via the ad-list endpoint in SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: Network GET requests to Binance APIs. 4. Sanitization: Not specified.
Audit Metadata