Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Bitcoin Daily

Daily digest of the Bitcoin Development mailing list and Bitcoin Core commits. Use when asked about recent bitcoin-dev discussions, mailing list activity, Bitcoin Core code changes, or to set up daily summaries. Fetches threads from groups.google.com/g/bitcoindev and commits from github.com/bitcoin/bitcoin.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
2 · 2.2k · 4 current installs · 4 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description match the implementation: the script fetches bitcoindev threads and bitcoin/bitcoin commits, summarizes and archives them. No unrelated credentials, binaries, or services are requested.
Instruction Scope
SKILL.md tells the agent to run the included node script to fetch, summarize, and archive data. The script only accesses public endpoints (groups.google.com, a gnusha.org mirror, and api.github.com), writes archive files to ~/workspace/bitcoin-dev-archive, and outputs a summary. The use of child_process.execSync to fetch Google Groups HTML is unusual but consistent with trying to retrieve page HTML; it does not read unrelated local files or transmit data to unexpected external endpoints.
Install Mechanism
There is no install spec and no external downloads; the skill is instruction + an included script. Nothing is fetched from non-standard hosts during install.
Credentials
The skill declares no required environment variables or credentials. The script uses process.env.HOME to build an archive path (normal). It makes unauthenticated GitHub API calls (rate-limited) but asks for no secrets.
Persistence & Privilege
always is false and the skill does not request permanent platform presence or modify other skills. It writes only to its own archive directory under the user's HOME; this is expected for an archiving digest.
Assessment
This skill appears to do what it says: fetch public mailing-list threads and GitHub commits, archive them under ~/workspace/bitcoin-dev-archive, and produce summaries. Things to consider before installing: (1) the script will create files in your HOME workspace—inspect and choose whether that path is acceptable; (2) it makes unauthenticated requests to the GitHub API (you may hit rate limits if used frequently); (3) it uses child_process.execSync to fetch Google Groups HTML (fragile but not inherently malicious); (4) since the skill can be run by the agent, review the included scripts yourself or run them in a sandbox if you have any doubts. No secrets are requested, and there are no external download URLs or hidden endpoints.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.3.2
Download zip
latestvk977v55e64e0sdrrqbqjpe9f3s804yw1

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

📰 Clawdis

SKILL.md

Bitcoin Dev Digest (📰)

Bitcoin Daily

Daily summary of bitcoindev mailing list + Bitcoin Core commits.

Made in 🤠 Texas ❤️ PlebLab

Commands

Run via: node ~/workspace/skills/bitcoin-daily/scripts/digest.js <command>

CommandDescription
digest [YYYY-MM-DD]Fetch & summarize (default: yesterday)
archiveList all archived digests
read <YYYY-MM-DD>Read a past summary

Output

The digest script fetches raw data. The agent then summarizes it for the user in this format:

Mailing list: Numbered list, each item with:

  • Bold title — 1-2 sentence ELI10 explanation with a touch of dry humor
  • Thread link

Commits: Bullet list of notable merges with PR links.

Keep summaries accessible — explain like the reader is smart but not a Bitcoin Core contributor. Dry humor welcome, not forced.

Archive

Raw data archived to ~/workspace/bitcoin-dev-archive/YYYY-MM-DD/:

  • mailing-list/*.json — full thread content per topic
  • mailing-list/_index.json — thread index
  • commits.json — raw commit data
  • summary.md — generated summary

Daily Cron

Set up via Clawdbot cron to run every morning. The digest script fetches, archives, and outputs a summary that the agent then sends to the user.

Sources

Files

6 total
Select a file
Select a file to preview.

Comments

Loading comments…