p2p

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: instruction override, no behavioural pass.

> **MUST follow:** When `complaintStatus` is 0, 1, or 2 (appeal still active), NEVER tell the user to "go to the app" or "head to the dispute center". Always guide them to use this skill to submit evi

Audit 0.4.1 · source sha d5ceffaa95a3 · 31 Oct 2026Report an issue or request a re-scan

• Publisherbinance GitHub organizationOwner of the repository this skill is read from
• Source folderbinance/binance-skills-hub/skills/binance/p2pThe exact folder we audited
• LicenceNot declaredAs the repository states it
• Commit pinned for this verdictd5ceffaa95a3A new audit runs when the source changes
• Repository statusNot archivedLast push 5 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Binance P2P trading assistant for natural-language queries about P2P/C2C market ads, the user's own P2P order history, order detail & appeal tracking, and advertisement publish & management.

---
name: p2p
description: |
  Binance P2P trading assistant for natural-language queries about P2P/C2C market ads, the user's own P2P order history, order detail & appeal tracking, and advertisement publish & management.

  Use when the user asks about P2P prices, searching/choosing ads, comparing payment methods, reviewing P2P order history, checking order detail/appeal status, querying complaints, publishing/updating/managing P2P advertisements, or viewing merchant profiles.

  Do NOT use for spot/futures prices, exchange trading, deposits/withdrawals, on-chain transfers, or anything unrelated to P2P/C2C.
---

# Binance P2P Trading Skill

Help users interact with **Binance P2P (C2C)** via natural-language queries.

## When to Use / When NOT to Use

### Use this skill when the user wants to:
- Check **P2P** buy/sell quotes for a crypto/fiat pair (e.g., USDT/CNY).
- Search **P2P advertisements** and filter by payment method(s), limits, merchant quality.
- Compare prices across payment methods (e.g., Alipay vs bank transfer).
- View **their own P2P order history / summary** (requires API key).
- Query **order detail** and view full order timeline (requires API key).
- Check **appeal/complaint status** and view complaint history (requires API key).
- **Submit evidence** for an existing appeal (upload files + submit description) (requires API key).
- **View complaint process timeline** (flow of actions, CS notes, evidence) (requires API key).
- **Cancel an existing appeal** (withdraw complaint, irreversible) (requires API key).
- **View available complaint reasons** for an order (requires API key).
- **Publish, update, or manage P2P advertisements** (requires API key + merchant permission).
- View **merchant profiles** and their ad listings (requires API key).
- Query **supported digital and fiat currencies** (requires API key).

### Do NOT use this skill when the user asks about:
- Spot/Convert prices, futures/derivatives, margin, trading bots.
- Deposits/withdrawals, wallet transfers, on-chain transactions.
- Creating/cancelling orders, releasing coins (trading operations). Cancelling **appeals** (complaints) IS supported.
- Initiating new appeals (submit-complaint is deferred; evidence supplement for existing appeals IS supported).
- Sending chat messages in order conversations.

### Ask clarifying questions (do not guess) if any key inputs are missing:
- `fiat` (e.g., CNY)
- `asset` (e.g., USDT)
- user intent: **buy crypto** or **sell crypto**
- preferred payment method(s)
- target amount (optional but recommended for ad filtering)

## Core Concepts

### `tradeType` mapping (avoid ambiguity)
- User wants to **buy crypto** (pay fiat, receive USDT/BTC) → `tradeType=BUY`
- User wants to **sell crypto** (receive fiat, pay USDT/BTC) → `tradeType=SELL`

Always reflect this mapping in responses when the user's wording is ambiguous.

## Capabilities

### Phase 1 — Public Market (No Auth)
- Quote P2P prices
- Search ads
- Compare payment methods
- Filter/Rank ads by limits and merchant indicators

### Phase 2 — Personal Orders (Requires API Key)
- List P2P order history
- Filter by trade type / time range
- Provide summary statistics

### Phase 3 — Order & Appeal + Ad Publish & Management (Requires API Key)
- Query order detail by order number
- List orders with rich filters (status, trade type, asset, date range)
- View order timeline (creation → payment → release → completion)
- Detect appeal status and show appeal details
- Query complaint/appeal records with filters
- Get market reference prices for pricing decisions
- Upload appeal evidence files (S3 presigned URL + submit)
- View complaint process timeline / flow details
- Cancel an existing appeal / withdraw complaint
- Get available complaint reasons for an order
- Search and analyze market ad distribution
- Get available ad categories for current user
- Get user's configured payment methods
- List all system trade methods
- Publish new advertisements (with confirmation)
- Update existing ad parameters (with confirmation)
- Update ad status: online / offline / close (with confirmation)
- View merchant profile and ad listings
- List all supported digital currencies
- List all supported fiat currencies

## Environment Configuration

### Base URLs (production)

| Logical Name | URL |
|-------------|-----|
| `SAPI_BASE` | `https://api.binance.com` |
| `MGS_BASE` | `https://www.binance.com` |
| `C2C_WEB` | `https://c2c.binance.com` |

### Implementation hint (for code generation)

When the skill generates curl / Python / JS code, use these fixed base URLs:

```python
import os

SAPI_BASE = "https://api.binance.com"
MGS_BASE  = "https://www.binance.com"
C2C_WEB   = "https://c2c.binance.com"

def common_headers(api_key: str) -> dict:
    return {
        "X-MBX-APIKEY": api_key,
        "User-Agent": "binance-wallet/1.0.0 (Skill)",
    }

# Usage:
# f"{SAPI_BASE}/sapi/v1/c2c/agent/orderMatch/getUserOrderDetail"
# f"{MGS_BASE}/bapi/c2c/v1/public/c2c/agent/quote-price"
# f"{C2C_WEB}/en/adv?code={advNo}"
# headers = common_headers(os.getenv("BINANCE_API_KEY"))
```

```bash
# Bash equivalent:
SAPI_BASE="https://api.binance.com"
MGS_BASE="https://www.binance.com"
C2C_WEB="https://c2c.binance.com"
```

> **Note:** SAPI signing uses HMAC SHA256, no param sorting required.

## Security & Privacy Rules

### Credentials
- Required env vars:
    - `BINANCE_API_KEY` (sent as header)
    - `BINANCE_SECRET_KEY` (used for signing)

### Never display full secrets
- API Key: show **first 5 + last 4** characters: `abc12...z789`
- Secret Key: always mask; show **only last 5**: `***...c123`

### Permission minimization
- Binance API permissions: **Enable Reading** only (Phase 1/2).
- Phase 3 ad management additionally needs write permissions.
- Do NOT request/encourage withdrawal or modification permissions beyond what's needed.

### Storage guidance
- Prefer environment injection (session/runtime env vars) over writing to disk.
- Only write to `.env` if the user

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/binance/binance-skills-hub
git -C binance-skills-hub checkout d5ceffaa95a3

Works in

1. 2026-10-31
   !CAUTION C 79 / 100

   first audit · source d5ceffaa95a3

Questions about p2p

• github.com/binance/binance-skills-hub/tree/main/skills/binance/p — the audited source at commit d5ceffaa95a3 and every finding aboveObserved · 31 Oct 2026

Spotted something wrong? Report a correction · Methodology