T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:41- Finding
Bitcoin Watch Address Disclosed to an Unintended Lookalike Domain
- Content
View full analysis
- Remediation
View remediation
Security audit
Btc Sovereign Tracker
Security checks for vulnerabilities and agentic risk
Overview
This read-only Bitcoin tracker is mostly coherent, but one documented UTXO command sends the watch address to a misspelled lookalike domain, creating an avoidable privacy risk.
Review this skill before installing if BTC address privacy matters to you. The main issue is the misspelled UTXO endpoint; it should be corrected to mempool.space or, preferably, replaced with a user-configured local node, Electrum server, or self-hosted mempool API before using a real watch address.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
Calling CoinGecko transmits usage metadata and may reveal user interest patterns, especially when correlated with other skill activity. In this skill’s context, the external price query is less sensitive than address lookups, but it still creates a third-party dependency and privacy leak that may matter to sovereignty-focused users.
- Content
Price Oracle (CoinGecko)
bash curl -s "https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=usd,eur,sek" | jq .COLDCARD Vault Health (via ZK-Bankir)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md |----------|---------|-------------| | `BTC_WATCH_ADDRESS` | (required) | Bitcoin address to monitor (watch-only) | | `MEMPOOL_API` | `https://mempool.space/api` | Mempool API base (change for self-hosted) | | `COINGECKO_API` | `https://api.coingecko.com/api/v3` | Price API base | | `ZK_BANKIR_HOST` | `http://localhost:3000` | ZK-Bankir server for vault status | ## Troubleshooting
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest description limits the skill to BTC self-custody metrics such as vault health, mempool fees, UTXO management, and on-chain verification. However, the documented core commands also include querying CoinGecko for BTC/USD/EUR/SEK price data, which is separate market-price tracking rather than an obvious self-custody or on-chain verification function.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The phrase "When the user asks for a BTC sovereignty status" is an imprecise invocation description rather than a specific trigger. It does not define concrete trigger phrases, scope boundaries, or negative examples, so related everyday requests about BTC status could ambiguously match.
- Content