binance-pay

The skill requires sensitive Binance Pay API credentials (BINANCE_PAY_API_KEY, BINANCE_PAY_SECRET, BINANCE_PAY_MERCHANT_ID) to be stored as environment variables. While environment variables are better than hardcoding, the instructions demonstrate direct usage of these credentials in bash commands without any validation, sanitization, or secure handling guidance. If an agent executes these commands with user-controlled input, credentials could be exposed through command injection, logging, or error messages. The skill provides no guidance on secure credential management, rotation, or access control.

SKILL.md

Environment Variables section requires: BINANCE_PAY_API_KEY, BINANCE_PAY_SECRET, BINANCE_PAY_MERCHANT_ID with direct usage in bash commands like API_KEY="${BINANCE_PAY_API_KEY}" and SECRET="${BINANCE_PAY_SECRET}"

The generate_signature() bash function uses echo with user-controlled variables (TIMESTAMP, NONCE, payload) without proper sanitization. The function constructs a sign_string using variables that could contain malicious shell metacharacters. While TIMESTAMP and NONCE are generated locally, the payload variable is constructed from user input (merchantTradeNo, orderAmount, currency, goodsName, etc.). An attacker could inject shell commands through these fields, leading to arbitrary command execution when the signature is generated.

SKILL.md

generate_signature() { local payload="$1"; local sign_string="${TIMESTAMP}\n${NONCE}\n${payload}\n"; echo -n "$sign_string" | openssl dgst -sha512 -hmac "$SECRET" | cut -d' ' -f2 | tr '[:lower:]' '[:upper:]'; }