derivatives-trading-portfolio-margin-pro

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill asks the agent to accept raw API key/secret files, store credentials in TOOLS.md, and perform signing/include X-MBX-APIKEY headers—actions that require access to raw secret values and could lead the LLM to include them verbatim (despite masking guidance), so there is a high exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to interact with Binance trading APIs and includes authenticated endpoints that perform financial actions (POST endpoints for BNB transfer, repay futures negative balance, earn-asset-transfer, switching delta/trade mode, portfolio loan/repay, etc.). It requires API key/secret and signing for transaction endpoints and includes behavior for confirming mainnet transactions. These are specific money-moving / trading operations (crypto exchange trades/transfers), not generic tooling, so it grants direct financial execution capability.