Use binance-cli for Binance Spot, Futures (USD-S), and Convert. Requires auth.

This skill is plausibly a legitimate Binance CLI wrapper (it installs a named npm package and documents many Binance endpoints), but there are two practical concerns: (1) it repeatedly says 'Requires auth' yet the package/skill metadata doesn't declare where API keys/secrets should be set (env vars, config path, or profile). Ask or inspect references/auth.md to confirm how credentials are provided and stored, and whether they are kept locally or written to a file. (2) The registry entry has no source or homepage; before installing, verify the npm package author/publisher and prefer official Binance-maintained releases (check publisher, package README, and GitHub repo). If you proceed, create API keys with the minimum permissions needed (avoid enabling withdrawal if not required), use IP-restrictions on keys where possible, and require manual CONFIRM for any production transactions (as SKILL.md suggests). If you cannot validate package origin or the auth flow, treat this skill as untrusted and do not install or provide live API credentials.

Type: OpenClaw Skill Name: binance-skills Version: 1.1.0 The skill bundle is a comprehensive wrapper for a Binance CLI tool, providing documentation and instructions for trading and account management. It contains proactive security guidelines in `references/auth.md` that explicitly instruct the AI agent to protect credentials (e.g., forbidding `printenv` or logging raw secrets) and requires explicit user confirmation for production transactions in `SKILL.md`. No evidence of malicious intent, data exfiltration, or obfuscation was found; the bundle appears well-structured and focused on its stated purpose.