bnbchain-mcp
Warn
Audited by Snyk on Mar 4, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 1.00). The skill explicitly starts the MCP server at runtime using "npx @bnb-chain/mcp@latest" (and links the repo https://github.com/bnb-chain/bnbchain-mcp), which fetches and executes remote code the skill depends on, so the external package controls runtime behavior.
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill is explicitly designed for on-chain financial operations. It documents use of a PRIVATE_KEY for state-changing actions and provides explicit tools/functions for sending transactions and managing assets: transfer_native_token, transfer_erc20, transfer_nft, transfer_erc1155, approve_token_spending, write_contract, plus Greenfield payment/write tools and wallet signing (get_address_from_private_key). These are direct crypto/blockchain transaction and signing capabilities (i.e., moving funds/assets), so it grants Direct Financial Execution authority.
Audit Metadata