Security audit

Bitcoin Daily

Security checks for vulnerabilities and agentic risk

Overview

This skill fetches public Bitcoin development sources and archives summaries as advertised, with some operational and prompt-injection risks users should understand.

Install only if you are comfortable with a daily job that fetches public Bitcoin development content and stores raw copies under ~/workspace/bitcoin-dev-archive. Treat fetched mailing-list text as untrusted, review or disable any cron schedule you enable, and periodically delete archives if you do not want indefinite retention.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: scripts/digest.js:267
Finding: Untrusted Mailing-List Content Is Exposed to Agent Instruction Hijacking
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/digest.js:374
Finding: Archive Read Command Permits Directory Traversal Outside the Archive Root
Content: View full analysis
'); process.exit(1); } const summaryPath = path.join(ARCHIVE_DIR, dateStr, 'summary.md'); if (!fs.existsSync(summaryPath)) { console.error(`❌ No archive for ${dateStr}`); process.exit(1); } ``` The resulting path is subsequently read with: ```js console.log(fs.readFileSync(summaryPath, 'utf8')); ``` ### Technical Analysis The `read` command describes its argument as a date, but it does not validate that the value matches the expected `YYYY-MM-DD` format. The value is passed directly to `path.join()` between the archive root and the fixed filename `summary.md`. `path.join()` normalizes `..` path components rather than confining the result to the original directory. An input such as `../../target` can therefore resolve to a path outside `ARCHIVE_DIR`. If the resulting external directory contains a readable file named `summary.md`, the script prints its contents. The fixed final filename limits exploitation to files named `summary.md`, so this is not an unrestricted arbitrary-file-read primitive. Nevertheless, it violates the intended archive boundary and can disclose accessible local data in suitably named files. Symlinked directories inside the archive could create an additional route outside the archive root. ### Attack Path 1. An attacker gains the ability to influence the argument passed to `digest.js read`, directly or through an Agent invoking the documented command. 2. The attacker supplies a traversal value, for example: ```text ../../target-directory ``` 3. The script evaluates a path equivalent to: ```text ~/workspace/bitcoin-dev-archive/../../target-directory/summary.md ``` 4. `path.join()` normalizes the traversal components, producing a location ...[truncated 769 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill invokes a Node.js script that fetches remote content and archives data locally, but the manifest does not declare any explicit tool scope or permissions boundaries. That makes the skill's effective capabilities opaque to reviewers and users, increasing the chance of unintended network access, environment access, or broader agent execution than expected.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly describes automatic daily cron execution and persistent archival of raw mailing-list and commit data, but it does not clearly warn users that it performs ongoing scheduled activity and writes files over time. This can surprise users, consume storage, create retention/privacy concerns, and cause the agent to continue operating beyond a one-time user request.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/digest.js (reported line 14)May include surrounding context.
js
const ARCHIVE_DIR = path.join(process.env.HOME, 'workspace', 'bitcoin-dev-archive'); const GROUPS_URL = 'https://groups.google.com/g/bitcoindev'; const GITHUB_API = 'https://api.github.com/repos/bitcoin/bitcoin/commits'; // ── Helpers ──

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The mailing-list fetch path invokes a child Node.js process via execSync even though the same task can be performed in-process. Introducing shell/process-spawning capability unnecessarily broadens the attack surface, increases operational risk, and can become dangerous if command construction is later modified to include untrusted input or if execution environment assumptions change.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script stores full fetched thread contents, commit data, and generated summaries under a persistent archive directory, while the skill description emphasizes fetching and summarizing recent activity rather than long-term raw-data retention. Persistently archiving third-party content expands the data footprint and retention risk, especially if mailing-list posts contain personal data or sensitive discussion details that users would not expect to be stored locally.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/digest.js:62

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/digest.js:12